AB 254: Confidentiality of Medical Information Act: reproductive or sexual health application information.
- Session Year: 2023-2024
- House: Assembly
- Latest Version Date: 2023-09-27
Current Status:
Passed
(2023-09-27: Chaptered by Secretary of State - Chapter 254, Statutes of 2023.)
Introduced
In Committee
First Chamber
In Committee
Second Chamber
Enacted
The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. The CMIA makes a business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individuals information or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care subject to the requirements of the CMIA. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor.
This bill would revise the definition of medical information to include reproductive or sexual health application information, which the bill would define to mean information about a consumers reproductive or sexual health collected by a reproductive or sexual health digital service, as specified. The bill would make a business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care subject to the requirements of the CMIA. Because the bill would expand the scope of a crime, it would impose a state-mandated local program.
This bill would incorporate additional changes to Section 56.05 of the Civil Code proposed by AB 1697 to be operative only if this bill and AB 1697 are enacted and this bill is enacted last.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. The CMIA makes a business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individuals information or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care subject to the requirements of the CMIA. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor.
This bill would revise the definition of medical information to include reproductive or sexual health application information, which the bill would define to mean information about a consumers reproductive or sexual health collected by a reproductive or sexual health digital service, as specified. The bill would make a business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care subject to the requirements of the CMIA. Because the bill would expand the scope of a crime, it would impose a state-mandated local program.
This bill would incorporate additional changes to Section 56.05 of the Civil Code proposed by AB 1697 to be operative only if this bill and AB 1697 are enacted and this bill is enacted last.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. The CMIA makes a business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individuals information or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care subject to the requirements of the CMIA. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor.
This bill would revise the definition of medical information to include reproductive or sexual health application information, which the bill would define to mean information about a consumers reproductive or sexual health collected by a reproductive or sexual health digital service, as specified. The bill would make a business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care subject to the requirements of the CMIA. Because the bill would expand the scope of a crime, it would impose a state-mandated local program.
This bill would incorporate additional changes to Section 56.05 of the Civil Code proposed by AB 1697 to be operative only if this bill and AB 1697 are enacted and this bill is enacted last.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. The CMIA makes a business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individuals information or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care subject to the requirements of the CMIA. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor.
This bill would revise the definition of medical information to include reproductive or sexual health application information, which the bill would define to mean information about a consumers reproductive or sexual health collected by a reproductive or sexual health digital service, as specified. The bill would make a business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care subject to the requirements of the CMIA. Because the bill would expand the scope of a crime, it would impose a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. The CMIA makes a business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care care, for purposes of allowing the individual to manage the individuals information or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care subject to the requirements of the CMIA. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor.
This bill would revise the definition of medical information to include reproductive or sexual health application information, which the bill would define to mean information related to about a consumers reproductive or sexual health collected by a reproductive or sexual health digital service. service, as specified. The bill would make a business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care subject to the requirements of the CMIA. Because the bill would expand the scope of a crime, it would impose a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. The CMIA makes a business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care for purposes of allowing the individual to manage the individuals information or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care subject to the requirements of the CMIA. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor.
This bill would revise the definition of medical information to include reproductive or sexual health application information, which the bill would define to mean information related to a consumers reproductive or sexual health collected by a reproductive or sexual health digital service. The bill would make a business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care subject to the requirements of the CMIA. Because the bill would expand the scope of a crime, it would impose a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
For purposes of this part:
(a)Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.
(b)Authorized recipient means a person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.
(c)Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to them at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.
(d)Contractor means a person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).
(e)Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.
(f)Health care service plan means an entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).
(g)Licensed health care professional means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.
(h)Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.
Marketing does not include any of the following:
(1)Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.
(2)Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.
(3)Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:
(A)The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.
(B)The individual is provided the opportunity to opt out of receiving future remunerated communications.
(C)The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. Further communication shall not be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt-out request.
(i)Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment. Individually identifiable means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patients name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the identity of the individual.
(j)Mental health application information means information related to a consumers inferred or diagnosed mental health or substance use disorder, as defined in Section 1374.72 of the Health and Safety Code, collected by a mental health digital service.
(k)Mental health digital service means a mobile-based application or internet website that collects mental health application information from a consumer, markets itself as facilitating mental health services to a consumer, and uses the information to facilitate mental health services to a consumer.
(l)Patient means a natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains.
(m)Pharmaceutical company means a company or business, or an agent or representative thereof, that manufactures, sells, or distributes pharmaceuticals, medications, or prescription drugs. Pharmaceutical company does not include a pharmaceutical benefits manager, as included in subdivision (c), or a provider of health care.
(n)Protected individual means any adult covered by the subscribers health care service plan or a minor who can consent to a health care service without the consent of a parent or legal guardian, pursuant to state or federal law. Protected individual does not include an individual that lacks the capacity to give informed consent for health care pursuant to Section 813 of the Probate Code.
(o)Provider of health care means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; a person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; a person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; or a clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code. Provider of health care does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code.
(p)Reproductive or sexual health application information means information about a consumers reproductive health, menstrual cycle, fertility, pregnancy, pregnancy outcome, plans to conceive, or type of sexual activity collected by a reproductive or sexual health digital service, including, but not limited to, information from which one can infer someones pregnancy status, menstrual cycle, fertility, hormone levels, birth control use, sexual activity, or gender identity.
(q)Reproductive or sexual health digital service means a mobile-based application or internet website that collects reproductive or sexual health application information from a consumer, markets itself as facilitating reproductive or sexual health services to a consumer, and uses the information to facilitate reproductive or sexual health services to a consumer.
(r)Sensitive services means all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care, and intimate partner violence, and includes services described in Sections 6924, 6925, 6926, 6927, 6928, 6929, and 6930 of the Family Code, and Sections 121020 and 124260 of the Health and Safety Code, obtained by a patient at or above the minimum age specified for consenting to the service specified in the section.
(s)Subscriber has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.
SEC. 1.5.Section 56.05 of the Civil Code is amended to read:56.05.For purposes of this part:
(a)Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.
(b)Authorized recipient means a person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.
(c)Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to them at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.
(d)Contractor means a person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).
(e)Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.
(f)Expiration date or event means a specified date or an occurrence relating to the individual to whom the medical information pertains or the purpose of the use or disclosure, after which the provider of health care, health care service plan, pharmaceutical company, or contractor is no longer authorized to disclose the medical information.
(g)Health care service plan means an entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).
(h)Licensed health care professional means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.
(i)Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.
Marketing does not include any of the following:
(1)Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.
(2)Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.
(3)Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:
(A)The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.
(B)The individual is provided the opportunity to opt out of receiving future remunerated communications.
(C)The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. Further communication shall not be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt-out request.
(j)Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment. Individually identifiable means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patients name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the identity of the individual.
(k)Mental health application information means information related to a consumers inferred or diagnosed mental health or substance use disorder, as defined in Section 1374.72 of the Health and Safety Code, collected by a mental health digital service.
(l)Mental health digital service means a mobile-based application or internet website that collects mental health application information from a consumer, markets itself as facilitating mental health services to a consumer, and uses the information to facilitate mental health services to a consumer.
(m)Patient means a natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains.
(n)Pharmaceutical company means a company or business, or an agent or representative thereof, that manufactures, sells, or distributes pharmaceuticals, medications, or prescription drugs. Pharmaceutical company does not include a pharmaceutical benefits manager, as included in subdivision (c), or a provider of health care.
(o)Protected individual means any adult covered by the subscribers health care service plan or a minor who can consent to a health care service without the consent of a parent or legal guardian, pursuant to state or federal law. Protected individual does not include an individual that lacks the capacity to give informed consent for health care pursuant to Section 813 of the Probate Code.
(p)Provider of health care means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; a person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; a person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; or a clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code. Provider of health care does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code.
(q)Reproductive or sexual health application information means information about a consumers reproductive health, menstrual cycle, fertility, pregnancy, pregnancy outcome, plans to conceive, or type of sexual activity collected by a reproductive or sexual health digital service, including, but not limited to, information from which one can infer someones pregnancy status, menstrual cycle, fertility, hormone levels, birth control use, sexual activity, or gender identity.
(r)Reproductive or sexual health digital service means a mobile-based application or internet website that collects reproductive or sexual health application information from a consumer, markets itself as facilitating reproductive or sexual health services to a consumer, and uses the information to facilitate reproductive or sexual health services to a consumer.
(s)Sensitive services means all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care, and intimate partner violence, and includes services described in Sections 6924, 6925, 6926, 6927, 6928, 6929, and 6930 of the Family Code, and Sections 121020 and 124260 of the Health and Safety Code, obtained by a patient at or above the minimum age specified for consenting to the service specified in the section.
(t)Subscriber has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.
SEC. 2.Section 56.06 of the Civil Code is amended to read:56.06.(a)Any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individuals information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(b)Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c)Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(d)Any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(e)Any business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including, but not limited to, laws that specifically incorporate by reference the definitions of this part.
(f)Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.
(g)Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.
SEC. 3.Section 1.5 of this bill incorporates amendments to Section 56.05 of the Civil Code proposed by both this bill and Assembly Bill 1697. That section of this bill shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2024, (2) each bill amends Section 56.05 of the Civil Code, and (3) this bill is enacted after Assembly Bill 1697, in which case Section 1 of this bill shall not become operative.
SEC. 4.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
For purposes of this part:
(a)Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.
(b)Authorized recipient means a person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.
(c)Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to them at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.
(d)Contractor means a person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).
(e)Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.
(f)Health care service plan means an entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).
(g)Licensed health care professional means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.
(h)Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.
Marketing does not include any of the following:
(1)Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.
(2)Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.
(3)Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:
(A)The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.
(B)The individual is provided the opportunity to opt out of receiving future remunerated communications.
(C)The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. Further communication shall not be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt-out request.
(i)Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment. Individually identifiable means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patients name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the identity of the individual.
(j)Mental health application information means information related to a consumers inferred or diagnosed mental health or substance use disorder, as defined in Section 1374.72 of the Health and Safety Code, collected by a mental health digital service.
(k)Mental health digital service means a mobile-based application or internet website that collects mental health application information from a consumer, markets itself as facilitating mental health services to a consumer, and uses the information to facilitate mental health services to a consumer.
(l)Patient means a natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains.
(m)Pharmaceutical company means a company or business, or an agent or representative thereof, that manufactures, sells, or distributes pharmaceuticals, medications, or prescription drugs. Pharmaceutical company does not include a pharmaceutical benefits manager, as included in subdivision (c), or a provider of health care.
(n)Protected individual means any adult covered by the subscribers health care service plan or a minor who can consent to a health care service without the consent of a parent or legal guardian, pursuant to state or federal law. Protected individual does not include an individual that lacks the capacity to give informed consent for health care pursuant to Section 813 of the Probate Code.
(o)Provider of health care means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; a person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; a person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; or a clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code. Provider of health care does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code.
(p)Reproductive or sexual health application information means information about a consumers reproductive health, menstrual cycle, fertility, pregnancy, pregnancy outcome, plans to conceive, or type of sexual activity collected by a reproductive or sexual health digital service, including, but not limited to, information from which one can infer someones pregnancy status, menstrual cycle, fertility, hormone levels, birth control use, sexual activity, or gender identity.
(q)Reproductive or sexual health digital service means a mobile-based application or internet website that collects reproductive or sexual health application information from a consumer, markets itself as facilitating reproductive or sexual health services to a consumer, and uses the information to facilitate reproductive or sexual health services to a consumer.
(r)Sensitive services means all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care, and intimate partner violence, and includes services described in Sections 6924, 6925, 6926, 6927, 6928, 6929, and 6930 of the Family Code, and Sections 121020 and 124260 of the Health and Safety Code, obtained by a patient at or above the minimum age specified for consenting to the service specified in the section.
(s)Subscriber has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.
SEC. 1.5.Section 56.05 of the Civil Code is amended to read:56.05.For purposes of this part:
(a)Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.
(b)Authorized recipient means a person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.
(c)Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to them at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.
(d)Contractor means a person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).
(e)Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.
(f)Expiration date or event means a specified date or an occurrence relating to the individual to whom the medical information pertains or the purpose of the use or disclosure, after which the provider of health care, health care service plan, pharmaceutical company, or contractor is no longer authorized to disclose the medical information.
(g)Health care service plan means an entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).
(h)Licensed health care professional means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.
(i)Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.
Marketing does not include any of the following:
(1)Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.
(2)Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.
(3)Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:
(A)The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.
(B)The individual is provided the opportunity to opt out of receiving future remunerated communications.
(C)The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. Further communication shall not be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt-out request.
(j)Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment. Individually identifiable means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patients name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the identity of the individual.
(k)Mental health application information means information related to a consumers inferred or diagnosed mental health or substance use disorder, as defined in Section 1374.72 of the Health and Safety Code, collected by a mental health digital service.
(l)Mental health digital service means a mobile-based application or internet website that collects mental health application information from a consumer, markets itself as facilitating mental health services to a consumer, and uses the information to facilitate mental health services to a consumer.
(m)Patient means a natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains.
(n)Pharmaceutical company means a company or business, or an agent or representative thereof, that manufactures, sells, or distributes pharmaceuticals, medications, or prescription drugs. Pharmaceutical company does not include a pharmaceutical benefits manager, as included in subdivision (c), or a provider of health care.
(o)Protected individual means any adult covered by the subscribers health care service plan or a minor who can consent to a health care service without the consent of a parent or legal guardian, pursuant to state or federal law. Protected individual does not include an individual that lacks the capacity to give informed consent for health care pursuant to Section 813 of the Probate Code.
(p)Provider of health care means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; a person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; a person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; or a clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code. Provider of health care does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code.
(q)Reproductive or sexual health application information means information about a consumers reproductive health, menstrual cycle, fertility, pregnancy, pregnancy outcome, plans to conceive, or type of sexual activity collected by a reproductive or sexual health digital service, including, but not limited to, information from which one can infer someones pregnancy status, menstrual cycle, fertility, hormone levels, birth control use, sexual activity, or gender identity.
(r)Reproductive or sexual health digital service means a mobile-based application or internet website that collects reproductive or sexual health application information from a consumer, markets itself as facilitating reproductive or sexual health services to a consumer, and uses the information to facilitate reproductive or sexual health services to a consumer.
(s)Sensitive services means all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care, and intimate partner violence, and includes services described in Sections 6924, 6925, 6926, 6927, 6928, 6929, and 6930 of the Family Code, and Sections 121020 and 124260 of the Health and Safety Code, obtained by a patient at or above the minimum age specified for consenting to the service specified in the section.
(t)Subscriber has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.
SEC. 2.Section 56.06 of the Civil Code is amended to read:56.06.(a)Any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individuals information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(b)Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c)Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(d)Any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(e)Any business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including, but not limited to, laws that specifically incorporate by reference the definitions of this part.
(f)Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.
(g)Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.
SEC. 3.Section 1.5 of this bill incorporates amendments to Section 56.05 of the Civil Code proposed by both this bill and Assembly Bill 1697. That section of this bill shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2024, (2) each bill amends Section 56.05 of the Civil Code, and (3) this bill is enacted after Assembly Bill 1697, in which case Section 1 of this bill shall not become operative.
SEC. 4.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
For purposes of this part:
(a)Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.
(b)Authorized recipient means a person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.
(c)Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to them at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.
(d)Contractor means a person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).
(e)Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.
(f)Health care service plan means an entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).
(g)Licensed health care professional means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.
(h)Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.
Marketing does not include any of the following:
(1)Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.
(2)Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.
(3)Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:
(A)The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.
(B)The individual is provided the opportunity to opt out of receiving future remunerated communications.
(C)The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. Further communication shall not be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt-out request.
(i)Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment. Individually identifiable means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patients name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the identity of the individual.
(j)Mental health application information means information related to a consumers inferred or diagnosed mental health or substance use disorder, as defined in Section 1374.72 of the Health and Safety Code, collected by a mental health digital service.
(k)Mental health digital service means a mobile-based application or internet website that collects mental health application information from a consumer, markets itself as facilitating mental health services to a consumer, and uses the information to facilitate mental health services to a consumer.
(l)Patient means a natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains.
(m)Pharmaceutical company means a company or business, or an agent or representative thereof, that manufactures, sells, or distributes pharmaceuticals, medications, or prescription drugs. Pharmaceutical company does not include a pharmaceutical benefits manager, as included in subdivision (c), or a provider of health care.
(n)Protected individual means any adult covered by the subscribers health care service plan or a minor who can consent to a health care service without the consent of a parent or legal guardian, pursuant to state or federal law. Protected individual does not include an individual that lacks the capacity to give informed consent for health care pursuant to Section 813 of the Probate Code.
(o)Provider of health care means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; a person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; a person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; or a clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code. Provider of health care does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code.
(p)Reproductive or sexual health application information means information about a consumers reproductive health, menstrual cycle, fertility, pregnancy, pregnancy outcome, plans to conceive, or type of sexual activity collected by a reproductive or sexual health digital service, including, but not limited to, information from which one can infer someones pregnancy status, menstrual cycle, fertility, hormone levels, birth control use, sexual activity, or gender identity.
(q)Reproductive or sexual health digital service means a mobile-based application or internet website that collects reproductive or sexual health application information from a consumer, markets itself as facilitating reproductive or sexual health services to a consumer, and uses the information to facilitate reproductive or sexual health services to a consumer.
(r)Sensitive services means all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care, and intimate partner violence, and includes services described in Sections 6924, 6925, 6926, 6927, 6928, 6929, and 6930 of the Family Code, and Sections 121020 and 124260 of the Health and Safety Code, obtained by a patient at or above the minimum age specified for consenting to the service specified in the section.
(s)Subscriber has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.
SEC. 1.5.Section 56.05 of the Civil Code is amended to read:56.05.For purposes of this part:
(a)Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.
(b)Authorized recipient means a person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.
(c)Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to them at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.
(d)Contractor means a person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).
(e)Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.
(f)Expiration date or event means a specified date or an occurrence relating to the individual to whom the medical information pertains or the purpose of the use or disclosure, after which the provider of health care, health care service plan, pharmaceutical company, or contractor is no longer authorized to disclose the medical information.
(f)(g)Health care service plan means an entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).
(g)(h)Licensed health care professional means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.
(h)(i)Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.
Marketing does not include any of the following:
(1)Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.
(2)Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.
(3)Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:
(A)The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.
(B)The individual is provided the opportunity to opt out of receiving future remunerated communications.
(C)The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. Further communication shall not be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt-out request.
(i)(j)Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment. Individually identifiable means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patients name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the identity of the individual.
(j)(k)Mental health application information means information related to a consumers inferred or diagnosed mental health or substance use disorder, as defined in Section 1374.72 of the Health and Safety Code, collected by a mental health digital service.
(k)(l)Mental health digital service means a mobile-based application or internet website that collects mental health application information from a consumer, markets itself as facilitating mental health services to a consumer, and uses the information to facilitate mental health services to a consumer.
(l)(m)Patient means a natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains.
(m)(n)Pharmaceutical company means a company or business, or an agent or representative thereof, that manufactures, sells, or distributes pharmaceuticals, medications, or prescription drugs. Pharmaceutical company does not include a pharmaceutical benefits manager, as included in subdivision (c), or a provider of health care.
(n)(o)Protected individual means any adult covered by the subscribers health care service plan or a minor who can consent to a health care service without the consent of a parent or legal guardian, pursuant to state or federal law. Protected individual does not include an individual that lacks the capacity to give informed consent for health care pursuant to Section 813 of the Probate Code.
(o)(p)Provider of health care means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; a person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; a person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; or a clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code. Provider of health care does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code.
(q)Reproductive or sexual health application information means information about a consumers reproductive health, menstrual cycle, fertility, pregnancy, pregnancy outcome, plans to conceive, or type of sexual activity collected by a reproductive or sexual health digital service, including, but not limited to, information from which one can infer someones pregnancy status, menstrual cycle, fertility, hormone levels, birth control use, sexual activity, or gender identity.
(r)Reproductive or sexual health digital service means a mobile-based application or internet website that collects reproductive or sexual health application information from a consumer, markets itself as facilitating reproductive or sexual health services to a consumer, and uses the information to facilitate reproductive or sexual health services to a consumer.
(p)(s)Sensitive services means all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care, and intimate partner violence, and includes services described in Sections 6924, 6925, 6926, 6927, 6928, 6929, and 6930 of the Family Code, and Sections 121020 and 124260 of the Health and Safety Code, obtained by a patient at or above the minimum age specified for consenting to the service specified in the section.
(q)(t)Subscriber has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.
SEC. 2.Section 56.06 of the Civil Code is amended to read:56.06.(a)Any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individuals information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(b)Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c)Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(d)Any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(e)Any business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including, but not limited to, laws that specifically incorporate by reference the definitions of this part.
(f)Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.
(g)Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.
SEC. 3.Section 1.5 of this bill incorporates amendments to Section 56.05 of the Civil Code proposed by both this bill and Assembly Bill 1697. That section of this bill shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2024, (2) each bill amends Section 56.05 of the Civil Code, and (3) this bill is enacted after Assembly Bill 1697, in which case Section 1 of this bill shall not become operative.
SEC. 3.SEC. 4.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
For purposes of this part:
(a)Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.
(b)Authorized recipient means a person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.
(c)Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to them at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.
(d)Contractor means a person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).
(e)Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.
(f)Health care service plan means an entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).
(g)Licensed health care professional means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.
(h)Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.
Marketing does not include any of the following:
(1)Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.
(2)Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.
(3)Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:
(A)The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.
(B)The individual is provided the opportunity to opt out of receiving future remunerated communications.
(C)The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. Further communication shall not be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt-out request.
(i)Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment. Individually identifiable means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patients name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the identity of the individual.
(j)Mental health application information means information related to a consumers inferred or diagnosed mental health or substance use disorder, as defined in Section 1374.72 of the Health and Safety Code, collected by a mental health digital service.
(k)Mental health digital service means a mobile-based application or internet website that collects mental health application information from a consumer, markets itself as facilitating mental health services to a consumer, and uses the information to facilitate mental health services to a consumer.
(l)Patient means a natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains.
(m)Pharmaceutical company means a company or business, or an agent or representative thereof, that manufactures, sells, or distributes pharmaceuticals, medications, or prescription drugs. Pharmaceutical company does not include a pharmaceutical benefits manager, as included in subdivision (c), or a provider of health care.
(n)Protected individual means any adult covered by the subscribers health care service plan or a minor who can consent to a health care service without the consent of a parent or legal guardian, pursuant to state or federal law. Protected individual does not include an individual that lacks the capacity to give informed consent for health care pursuant to Section 813 of the Probate Code.
(o)Provider of health care means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; a person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; a person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; or a clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code. Provider of health care does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code.
(p)Reproductive or sexual health application information means information about a consumers reproductive health, menstrual cycle, fertility, pregnancy, miscarriage, pregnancy termination, pregnancy outcome, plans to conceive, or type of sexual activity collected by a reproductive or sexual health digital service, including, but not limited to, information from which one can infer someones pregnancy status, menstrual cycle, fertility, hormone levels, birth control use, sexual activity, or gender identity.
(q)Reproductive or sexual health digital service means a mobile-based application or internet website that collects reproductive or sexual health application information from a consumer, markets itself as facilitating reproductive or sexual health services to a consumer, and uses the information to facilitate reproductive or sexual health services to a consumer.
(r)Sensitive services means all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care, and intimate partner violence, and includes services described in Sections 6924, 6925, 6926, 6927, 6928, 6929, and 6930 of the Family Code, and Sections 121020 and 124260 of the Health and Safety Code, obtained by a patient at or above the minimum age specified for consenting to the service specified in the section.
(s)Subscriber has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.
SEC. 2.Section 56.06 of the Civil Code is amended to read:56.06.(a)Any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individuals information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(b)Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c)Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(d)Any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(e)Any business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including including, but not limited to, laws that specifically incorporate by reference the definitions of this part.
(f)Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.
(g)Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.
SEC. 3.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
For purposes of this part:
(a)Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.
(b)Authorized recipient means a person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.
(c)Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to them at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.
(d)Contractor means a person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).
(e)Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.
(f)Health care service plan means an entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).
(g)Licensed health care professional means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.
(h)Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.
Marketing does not include any of the following:
(1)Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.
(2)Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.
(3)Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:
(A)The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.
(B)The individual is provided the opportunity to opt out of receiving future remunerated communications.
(C)The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. Further communication shall not be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt-out request.
(i)Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment. Individually identifiable means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patients name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the identity of the individual.
(j)Mental health application information means information related to a consumers inferred or diagnosed mental health or substance use disorder, as defined in Section 1374.72 of the Health and Safety Code, collected by a mental health digital service.
(k)Mental health digital service means a mobile-based application or internet website that collects mental health application information from a consumer, markets itself as facilitating mental health services to a consumer, and uses the information to facilitate mental health services to a consumer.
(l)Patient means a natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains.
(m)Pharmaceutical company means a company or business, or an agent or representative thereof, that manufactures, sells, or distributes pharmaceuticals, medications, or prescription drugs. Pharmaceutical company does not include a pharmaceutical benefits manager, as included in subdivision (c), or a provider of health care.
(n)Protected individual means any adult covered by the subscribers health care service plan or a minor who can consent to a health care service without the consent of a parent or legal guardian, pursuant to state or federal law. Protected individual does not include an individual that lacks the capacity to give informed consent for health care pursuant to Section 813 of the Probate Code.
(o)Provider of health care means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; a person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; a person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; or a clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code. Provider of health care does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code.
(p)Reproductive or sexual health application information means information related to about a consumers reproductive or sexual health health, menstrual cycle, fertility, pregnancy, miscarriage, pregnancy termination, plans to conceive, or type of sexual activity collected by a reproductive or sexual health digital service. service, including, but not limited to, information from which one can infer someones pregnancy status, menstrual cycle, fertility, hormone levels, birth control use, sexual activity, or gender identity.
(q)Reproductive or sexual health digital service means a mobile-based application or internet website that collects reproductive or sexual health application information from a consumer, markets itself as facilitating reproductive or sexual health services to a consumer, and uses the information to facilitate reproductive or sexual health services to a consumer.
(r)Sensitive services means all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care, and intimate partner violence, and includes services described in Sections 6924, 6925, 6926, 6927, 6928, 6929, and 6930 of the Family Code, and Sections 121020 and 124260 of the Health and Safety Code, obtained by a patient at or above the minimum age specified for consenting to the service specified in the section.
(s)Subscriber has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.
SEC. 2.Section 56.06 of the Civil Code is amended to read:56.06.(a)Any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individuals information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(b)Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c)Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(d)Any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(e)Any business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(f)Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.
(g)Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.
SEC. 3.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
REVISIONS: HeadingLine 4.For purposes of this part:
(a)Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.
(b)Authorized recipient means a person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.
(c)Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to them at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.
(d)Contractor means a person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).
(e)Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.
(f)Health care service plan means an entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).
(g)Licensed health care professional means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.
(h)Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.
Marketing does not include any of the following:
(1)Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.
(2)Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.
(3)Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:
(A)The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.
(B)The individual is provided the opportunity to opt out of receiving future remunerated communications.
(C)The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. Further communication shall not be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt-out request.
(i)Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment. Individually identifiable means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patients name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the identity of the individual.
(j)Mental health application information means information related to a consumers inferred or diagnosed mental health or substance use disorder, as defined in Section 1374.72 of the Health and Safety Code, collected by a mental health digital service.
(k)Mental health digital service means a mobile-based application or internet website that collects mental health application information from a consumer, markets itself as facilitating mental health services to a consumer, and uses the information to facilitate mental health services to a consumer.
(l)Patient means a natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains.
(m)Pharmaceutical company means a company or business, or an agent or representative thereof, that manufactures, sells, or distributes pharmaceuticals, medications, or prescription drugs. Pharmaceutical company does not include a pharmaceutical benefits manager, as included in subdivision (c), or a provider of health care.
(n)Protected individual means any adult covered by the subscribers health care service plan or a minor who can consent to a health care service without the consent of a parent or legal guardian, pursuant to state or federal law. Protected individual does not include an individual that lacks the capacity to give informed consent for health care pursuant to Section 813 of the Probate Code.
(o)Provider of health care means a person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; a person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; a person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; or a clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code. Provider of health care does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code.
(p)Reproductive or sexual health application information means information related to a consumers reproductive or sexual health collected by a reproductive or sexual health digital service.
(q)Reproductive or sexual health digital service means a mobile-based application or internet website that collects reproductive or sexual health application information from a consumer, markets itself as facilitating reproductive or sexual health services to a consumer, and uses the information to facilitate reproductive or sexual health services to a consumer.
(p)(r)Sensitive services means all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care, and intimate partner violence, and includes services described in Sections 6924, 6925, 6926, 6927, 6928, 6929, and 6930 of the Family Code, and Sections 121020 and 124260 of the Health and Safety Code, obtained by a patient at or above the minimum age specified for consenting to the service specified in the section.
(q)(s)Subscriber has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.
SEC. 2.Section 56.06 of the Civil Code is amended to read:56.06.(a)Any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their the individuals information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(b)Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c)Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(d)Any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(e)Any business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individuals information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(e)(f)Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.
(f)(g)Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.
SEC. 3.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
REVISIONS: HeadingLine 2.|
Date
|
Status
|
|---|---|
| Sep 27, 2023 | Chaptered by Secretary of State - Chapter 254, Statutes of 2023. |
| Sep 27, 2023 | Approved by the Governor. |
| Sep 13, 2023 | Enrolled and presented to the Governor at 3 p.m. |
| Sep 7, 2023 | Senate amendments concurred in. To Engrossing and Enrolling. (Ayes 77. Noes 0. Page 3037.). |
| Sep 7, 2023 | Assembly Rule 77 suspended. (Page 3011.) |
| Sep 6, 2023 | In Assembly. Concurrence in Senate amendments pending. May be considered on or after September 8 pursuant to Assembly Rule 77. |
| Sep 6, 2023 | Read third time. Passed. Ordered to the Assembly. (Ayes 40. Noes 0. Page 2416.). |
| Sep 5, 2023 | Read second time. Ordered to third reading. |
| Sep 1, 2023 | Read third time and amended. Ordered to second reading. |
| Aug 21, 2023 | Read second time. Ordered to third reading. |
| Aug 17, 2023 | Read third time and amended. Ordered to second reading. |
| Aug 15, 2023 | Read second time. Ordered to third reading. |
| Aug 14, 2023 | From committee: Be ordered to second reading pursuant to Senate Rule 28.8. |
| Jul 6, 2023 | From committee: Do pass and re-refer to Com. on APPR. (Ayes 11. Noes 1.) (July 5). Re-referred to Com. on APPR. |
| Jun 14, 2023 | From committee: Do pass and re-refer to Com. on HEALTH. (Ayes 9. Noes 0.) (June 13). Re-referred to Com. on HEALTH. |
| May 31, 2023 | Referred to Coms. on JUD. and HEALTH. |
| May 23, 2023 | In Senate. Read first time. To Com. on RLS. for assignment. |
| May 22, 2023 | Read third time. Passed. Ordered to the Senate. (Ayes 76. Noes 0. Page 1691.) |
| May 11, 2023 | Read second time. Ordered to third reading. |
| May 10, 2023 | From committee: Do pass. (Ayes 15. Noes 0.) (May 10). |
| Apr 26, 2023 | From committee: Do pass and re-refer to Com. on APPR. (Ayes 10. Noes 0.) (April 25). Re-referred to Com. on APPR. |
| Apr 26, 2023 | Coauthors revised. |
| Apr 18, 2023 | Re-referred to Com. on P. & C.P. |
| Apr 17, 2023 | From committee chair, with author's amendments: Amend, and re-refer to Com. on P. & C.P. Read second time and amended. |
| Mar 15, 2023 | From committee: Do pass and re-refer to Com. on P. & C.P. (Ayes 13. Noes 0.) (March 14). Re-referred to Com. on P. & C.P. |
| Mar 15, 2023 | Coauthors revised. |
| Feb 2, 2023 | Referred to Coms. on HEALTH and P. & C.P. |
| Jan 20, 2023 | From printer. May be heard in committee February 19. |
| Jan 19, 2023 | Read first time. To print. |
|
Date
|
Description
|
Location
|
Votes
|
|
|---|---|---|---|---|
| Sep 7, 2023 | AB 254 Bauer-Kahan Concurrence in Senate Amendments | Assembly Floor |
Passed |
|
| Sep 6, 2023 | Assembly 3rd Reading AB254 Bauer-Kahan et al. By Ashby | Senate Floor |
Passed |
|
| Jul 5, 2023 | Do pass, but first be re-referred to the Committee on [Appropriations] | Senate Standing Committee on Health |
Passed |
|
| Jun 13, 2023 | Do pass, but first be re-referred to the Committee on [Health] | Senate Standing Committee on Judiciary |
Passed |
|
| May 22, 2023 | AB 254 Bauer-Kahan Assembly Third Reading | Assembly Floor |
Passed |
|
| May 10, 2023 | Do pass. | Assembly Standing Committee on Appropriations |
Passed |
|
| Apr 25, 2023 | Do pass and be re-referred to the Committee on [Appropriations] | Assembly Standing Committee on Privacy and Consumer Protection |
Passed |
|
| Mar 14, 2023 | Do pass and be re-referred to the Committee on [Privacy and Consumer Protection] | Assembly Standing Committee on Health |
Passed |
This list shows positions taken on this bill by organizations on the date displayed, which is linked to the original source.
Positions by individuals are not included.
|
Organization
|
Position
|
Date
|
|---|---|---|
| #ShePersisted | ** Support | |
| Access Now | ** Support | |
| AccessNow | ** Support | |
| Accountable Tech | ** Support | |
| Aclu California Action | ** Support | |
| ADL | ** Support | |
| American Association Of University Women California | ** Support | |
| American Association of University Women San Jose | ** Support | |
| American College Of Obstetricians And Gynecologists District Ix | ** Support | |
| Anti-Defamation League | ** Support | |
| ARIA Medical Clinic | * Support | Apr 25, 2023 |
| Attorney General Rob Bonta | ** Support | |
| California Academy Of Family Physicians | ** Support | |
| California Federation Of Teachers | ** Support | |
| California Health Plus Advocates | * Support | Jul 5, 2023 |
| California Latinas for Reproductive Justice | * Support | Apr 25, 2023 |
| California Legislative Women's Caucus | ** Support | |
| California Medical Association | * Support | Jun 13, 2023 |
| California Nurse Midwives Association | ** Support | |
| California Pan - Ethnic Health Network | ** Support | |
| center for digital democracy | ** Support | |
| CFA | ** Support | |
| City & County of San Francisco | * Support | Jul 5, 2023 |
| City and County of San Francisco Department on the Status of Women | ** Support | |
| Consumer Federation of America | ** Support | |
| Consumer Reports | ** Support | |
| Demand Progress | ** Support | |
| Doctors In Politics | ** Support | |
| EKO | ** Support | |
| Eko Health | ** Support | |
| Electronic Frontier Foundation | ** Support | |
| Electronic Privacy Information Center | ** Support | |
| epic.org | ** Support | |
| Equality California | ** Support | |
| Fairplay | ** Support | |
| Fight For The Future | ** Support | |
| Free Press | ** Support | |
| Free Press Action | ** Support | |
| Friends Of The Earth | ** Support | |
| glaad | ** Support | |
| Health Care Voices | ** Support | |
| Health Officers Association Of California | ** Support | |
| KAIROS | ** Support | |
| Kairos Action | ** Support | |
| Lieutenant Governor Eleni Kounalakis | ** Support | |
| Mozilla | ** Support | |
| Mozilla Foundation | * Support | Apr 25, 2023 |
| MYA Network | * Support | Apr 25, 2023 |
| NARAL Pro-Choice California | ** Support | |
| National Association Of Social Workers, California Chapter | ** Support | |
| Oakland Privacy | ** Support | |
| Planned Parenthood Affiliates Of California | * Support | Jun 13, 2023 |
| She Persisted | ** Support | |
| Sister Song | ** Support | |
| Sister Song: National Women of Color Reproductive Justice Collective | ** Support | |
| Super-majority | ** Support | |
| Ultraviolet Action | ** Support | |
| Vote Pro Choice | ** Support | |
| VoteProChoice | ** Support |
CONCURRENCE IN SENATE AMENDMENTS
CSA1 Bill Id:AB 254
Author:(Bauer-Kahan)
As Amended Ver:September 1, 2023
Majority vote
SUMMARY
Revises the Confidentiality of Medical Information Act (CMIA) to include reproductive or sexual health application information into the definition of medical information. Defines reproductive or sexual health application information to mean information about a consumer's reproductive health, menstrual cycle, fertility, pregnancy, pregnancy outcome, plans to conceive, or type of sexual activity collected by a reproductive or sexual health digital service, including, but not limited to, information from which one can infer someone's pregnancy status, menstrual cycle, fertility, hormone levels, birth control use, sexual activity, or gender identity. Defines reproductive or sexual health digital service to mean a mobile-based application or internet website that collects reproductive or sexual health application information from a consumer, markets itself as facilitating reproductive or sexual health services to a consumer, and uses the information to facilitate reproductive or sexual health services to a consumer. Deems a business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individual's information, or for the individual's diagnosis, treatment, or management of a medical condition, to be a provider of health care, as specified.
Senate Amendments
Revise the definition of reproductive or sexual health application information to mean pregnancy outcome instead of miscarriage or pregnancy termination. Incorporates additional changes to this bill proposed by AB 1697 (Schiavo), of the current session, to be operative only if this bill and AB 1697 are enacted and this bill is enacted last.
COMMENTS
Reproductive and sexual health information is clearly health information, and is particularly sensitive given the criminalization of almost any form of ending a pregnancy. The author points out that current data protections do not speak to the sensitivity of this data. Apps and websites that explicitly market themselves as providing menstrual and pregnancy tracking are creating an expectation of healthcare and the associated privacy of information. The author concludes that by adding CMIA protections for these services is a critical and common sense step to ensure a sufficient baseline of privacy to protect consumers.
According to the Author
The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule provides consumers with important privacy rights and protections with respect to their health information, including important controls over how their health information is used and disclosed by health plans and health care providers. Ensuring strong privacy protections is critical to maintaining individuals' trust in their health care providers and willingness to obtain needed health care services, and these protections are especially important where very sensitive information is concerned, such as mental health and reproductive health information.
Federal guidance. According to the U.S. Department of Health and Human Services Agency (HHSA), the HIPAA Privacy Rule protects the privacy and security of medical and other health information when it is transmitted or maintained by covered entities (health plans, most health care providers, health care clearinghouses) and business associates (people and companies that provide certain services for covered entities). This information is referred to as protected health information (PHI), and it includes individually identifying information, such as name, address, age, social security number, and location, as well as information about health history, any diagnoses or conditions, current health status, and more. According to the HHSA, the HIPAA Rules generally do not protect the privacy or security of health information when it is accessed through or stored on personal cell phones or tablets. The HIPAA Rules apply only when PHI is created, received, maintained, or transmitted by covered entities and business associates. For example, the HIPAA Rules do not protect the privacy of Internet search history, information voluntarily shared online, or geographic location information. In most cases, unless the app is provided by a covered entity or its business associate, the HIPAA Rules also do not protect the privacy of data downloaded or entered into mobile apps for personal use. The information that devices or apps collect about you may be viewed or collected by other entities or used by the device or app vendors to send specific ads. It may also be sold to a data broker, someone who obtains and shares consumer information without their knowledge, often selling it for marketing or other purposes. For specific apps, individual apps may have collected information about location and activities, including the name and location of doctors' offices and the time and date of any visits. For example, apps for social media, directions and maps, and ride sharing often collect location or activity information.
In response to the Supreme Court ruling in Dobbs vs. Jackson Women's Health Organization (the Supreme Court Case that held that the Constitution does not confer a right to abortion; Roe and Casey are overruled; and the authority to regulate abortion is returned to the people and their elected representatives), HHSA took action to protect access to sexual and reproductive health care, including abortion, pregnancy complications, and other related care. The HHSA Office for Civil Rights (OCR) issued guidance to help protect patients seeking reproductive health care, as well as their providers. In general, the guidance does two things:
- Addresses how federal law and regulations protect individuals' PHI relating to abortion and other sexual and reproductive health care, making it clear that providers are not required to disclose private medical information to third parties; and,
- Addresses the extent to which private medical information is protected on personal cell phones and tablets, and provides tips for protecting individuals' privacy when using period trackers and other health information apps.
According to the HHSA, many patients are concerned that period trackers and other health information apps on smartphones may threaten their right to privacy by disclosing geolocation data which may be misused by those seeking to deny care. The OCR guidance addresses the circumstances under which the HIPAA Privacy Rule permits disclosure of PHI without an individual's authorization. It explains that disclosures for purposes not related to health care, such as disclosures to law enforcement officials, are permitted only in narrow circumstances tailored to protect the individual's privacy and support their access to health care, including abortion care. Specifically, the guidance:
- Reminds HIPAA covered entities and business associates that they can use and disclose PHI, without an individual's signed authorization, only as expressly permitted or required by the HIPAA Privacy Rule; and,
- Explains the HIPAA Privacy Rule's restrictions on disclosures of PHI when required by law, for law enforcement purposes, and to avert a serious threat to health or safety.
A 2022 Los Angeles Times article, entitled, "How data from period-tracking and pregnancy apps could be used to prosecute pregnant people" described a recent report indicating that many popular reproductive health apps are lacking when it comes to protecting users' data privacy and many of the apps had vague privacy policies that did not spell out what data could be shared with government agencies or law enforcement. According to the article, health data input into most period-tracking apps is not subject to HIPAA. A vague privacy policy can mean users will not know what data are being shared, with whom and under what circumstances, forcing users to blindly trust a company to protect their information. This bill would ensure that reproductive or sexual health digital service information is protected under the CMIA.
Arguments in Support
The California Pan-Ethnic Health Network (CPEHN) states that this bill will ensure that users can be assured that sensitive digital information about their reproductive and sexual health will have the same protections and privacy as their medical information. Thus, this bill will create continuous data protection across health platforms for abortion and gender-affirming care. CPEHN believes that this bill will increase not only privacy and protection but also equitable and safe access for communities of color who request sexual reproductive health services digitally. Oakland Privacy writes that this bill will provide the express inclusion of privacy protections of reproductive and sexual health digital products and services under the CMIA. This privacy expansion is a vital and necessary component to protect consumer's personal health data, protect privacy, and reduce the potential of facing discrimination harms.
Arguments in Opposition
There is no known opposition.
FISCAL COMMENTS
According to the Senate Appropriations Committee, pursuant to Senate Rule 28.8, negligible state costs.
VOTES:
ASM HEALTH: 13-0-2
YES: Wood, Waldron, Aguiar-Curry, Arambula, Boerner Horvath, Lackey, Maienschein, McCarty, Joe Patterson, Rodriguez, Santiago, Villapudua, Weber
ABS, ABST OR NV: Wendy Carrillo, Flora
ASM PRIVACY AND CONSUMER PROTECTION: 10-0-1
YES: Gabriel, Joe Patterson, Bauer-Kahan, Bennett, Essayli, Irwin, Lowenthal, Papan, Wicks, Wilson
ABS, ABST OR NV: Vince Fong
ASM APPROPRIATIONS: 15-0-1
YES: Holden, Megan Dahle, Bryan, Calderon, Wendy Carrillo, Dixon, Mike Fong, Addis, Lowenthal, Papan, Pellerin, Robert Rivas, Sanchez, Weber, Wilson
ABS, ABST OR NV: Mathis
ASSEMBLY FLOOR: 76-0-4
YES: Addis, Aguiar-Curry, Alanis, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Wendy Carrillo, Cervantes, Connolly, Megan Dahle, Davies, Dixon, Essayli, Flora, Mike Fong, Friedman, Gabriel, Gallagher, Garcia, Gipson, Grayson, Haney, Hart, Holden, Hoover, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, Mathis, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Jim Patterson, Joe Patterson, Pellerin, Petrie-Norris, Ramos, Reyes, Luz Rivas, Robert Rivas, Rodriguez, Blanca Rubio, Sanchez, Santiago, Schiavo, Soria, Ta, Ting, Valencia, Villapudua, Waldron, Wallis, Ward, Weber, Wicks, Wilson, Wood, Zbur, Rendon
ABS, ABST OR NV: Chen, Vince Fong, Lackey, Quirk-Silva
SENATE FLOOR: 40-0-0
YES: Allen, Alvarado-Gil, Archuleta, Ashby, Atkins, Becker, Blakespear, Bradford, Caballero, Cortese, Dahle, Dodd, Durazo, Eggman, Glazer, Gonzalez, Grove, Hurtado, Jones, Laird, Limón, McGuire, Menjivar, Min, Newman, Nguyen, Niello, Ochoa Bogh, Padilla, Portantino, Roth, Rubio, Seyarto, Skinner, Smallwood-Cuevas, Stern, Umberg, Wahab, Wiener, Wilk
UPDATED
VERSION: September 1, 2023
CONSULTANT: Kristene Mapile / HEALTH / (916) 319-2097 FN: 0001680
SENATE RULES COMMITTEE Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 | AB 254 |
THIRD READING
Bill No: AB 254
Author: Bauer-Kahan (D), et al.
Amended: 9/1/23 in Senate
Vote: 21
SENATE JUDICIARY COMMITTEE: 9-0, 6/13/23
AYES: Umberg, Allen, Ashby, Caballero, Durazo, Laird, Min, Niello, Wiener
NO VOTE RECORDED: Wilk, Stern
SENATE HEALTH COMMITTEE: 11-1, 7/5/23
AYES: Eggman, Nguyen, Glazer, Gonzalez, Hurtado, Limón, Menjivar, Roth, Rubio, Wahab, Wiener
NOES: Grove
SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8
ASSEMBLY FLOOR: 76-0, 5/22/23 - See last page for vote
SUBJECT: Confidentiality of Medical Information Act: reproductive or sexual health application information
SOURCE: Lieutenant Governor Eleni Kounalakis
DIGEST:
This bill includes “reproductive or sexual health application information” in the definition of “medical information” and the businesses that offer reproductive or sexual health digital services to consumers in the definition of a provider of health care for purposes of the Confidentiality of Medical Information Act (CMIA).
Senate Floor Amendments of 9/1/23 prevent chaptering out issues with AB 1697.
Senate Floor Amendments of 8/17/23 replace certain terms referring to pregnancy outcomes in the definition of the relevant application information with simply “pregnancy outcome.”
ANALYSIS:
Existing federal law:
- Establishes the Health Insurance Portability and Accountability Act (HIPAA), which provides privacy protections for patients’ protected health information and generally prohibits a covered entity, as defined (health plan, health care provider, and health care clearing house), from using or disclosing protected health information except as specified or as authorized by the patient in writing. (45 C.F.R. § 164.500 et seq.)
- Provides that if HIPAA’s provisions conflict with a provision of state law, the provision that is the most protective of patient privacy prevails. (45 C.F.R. § 164.500 et seq.)
Existing state law:
- Provides, pursuant to the California Constitution, that all people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy. (Cal. Const., art. I, § 1.)
- Holds that the state constitution’s express right to privacy extends to an individual’s decision about whether or not to have an abortion. (People v. Belous (1969) 71 Cal.2d 954.)
- Establishes the CMIA, which establishes protections for the use of medical information. (Civ. Code § 56 et seq.)
- Prohibits providers of health care, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code § 56.10.)
- Defines “medical information,” for purposes of CMIA, to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental health application information, mental or physical condition, or treatment. (Civ. Code § 56.05(i).)
- Defines “provider of health care,” for purposes of CMIA, to mean any person licensed or certified pursuant to the Business and Professions Code, as specified; the Osteopathic Initiative Act or the Chiropractic Initiative Act; the Health and Safety Code, as specified; or any licensed clinic, health dispensary, or health facility, as specified. The term does not include insurance institutions, as defined. (Civ. Code § 56.05(o).)
This bill:
- Defines “reproductive or sexual health digital service” as a mobile-based application or internet website that collects reproductive or sexual health application information from a consumer, markets itself as facilitating reproductive or sexual health services to a consumer, and uses the information to facilitate reproductive or sexual health services to a consumer.
- Defines “reproductive or sexual health application information” as information about a consumer’s reproductive health, menstrual cycle, fertility, pregnancy, pregnancy outcome, plans to conceive, or type of sexual activity collected by a reproductive or sexual health digital service, including, but not limited to, information from which one can infer someone’s pregnancy status, menstrual cycle, fertility, hormone levels, birth control use, sexual activity, or gender identity.
- Includes reproductive or sexual health application information in the definition of “medical information” in CMIA.
- Provides that a business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of CMIA.
Background
Existing California and federal law strictly govern the use of a patient’s medical information. These statutory frameworks favor the privacy of the patient, with caveats for the sharing of medical information when necessary for treatment. California’s CMIA allows adult patients in California to keep personal health information confidential and decide whether and when to share that information. CMIA protects “medical information,” and restricts its disclosure by “providers of health care” and “health care service plans,” as defined and specified.
The use of digital health products and services that collect and transmit certain health data raises serious privacy concerns. Given the increasingly hostile environment around reproductive and gender-affirming healthcare, this bill addresses digital services that collect reproductive or sexual health information from consumers and that are offered by businesses for the purpose of allowing individuals to manage that information or even for diagnosis, treatment, or management of a medical condition. This bill deems the application information as medical information and the businesses offering them as providers of health care, bringing them within the protective ambit of CMIA.
This bill is sponsored by Lieutenant Governor Eleni Kounalakis and supported by various consumer and privacy groups, including the ACLU California Action. There is no known opposition.
[NOTE: A more thorough discussion of this bill can be found in the Senate Judiciary Committee analysis, which is incorporated herein by reference.]
Comments
- Author’s comments. According to the author, “Reproductive and sexual health information is clearly health information, and is particularly sensitive given the criminalization of almost any form of ending a pregnancy. Our current data protections do not speak to the sensitivity of this data. Apps and websites that explicitly market themselves as providing menstrual and pregnancy tracking are creating an expectation of healthcare and the associated privacy of information. Adding CMIA protections for these services is a critical and common sense step to ensure a sufficient baseline of privacy to protect consumers.”
- Extending existing protections to reproductive or sexual health application information. The concern with reproductive or sexual health applications and online services is that while reproductive, or sexual health, information collected by a heath professional would be considered “medical information” and covered by existing medical privacy laws, because this information is being collected by apps and websites, meaning at the patient level and outside of a medical facility, it will not necessarily be captured under the existing definition of medical information.
The results of a Consumer Reports investigation frames the issue well:
If you use an app to track your menstrual cycle, you may enjoy the sometimes spot-on predictions about when your next period is coming. But your period-tracking app doesn’t just offer insight. It gathers a lot of data about you along the way, too—maybe even more than you know.
Period tracker apps collect deeply personal information that can include how often you have sex, whether you are trying to have a baby, if you get pregnant, and if you experience a miscarriage. When Consumer Reports last evaluated period tracker apps in 2020, our Digital Lab, which tests how well products and services protect consumers’ privacy, found that the five apps we evaluated—which all store users’ data in the cloud—provided no guarantee that this information would not be shared with third parties, even when users thought they were anonymous.
These lax privacy protections have long been a concern because users’ data can be used to target them with ads or even possibly to determine life insurance coverage or loan interest rates. Now that the Supreme Court has overturned Roe v. Wade—ending the constitutional right to an abortion—many app users may be newly worried that data about their fertility, missed periods, and more could be used against them in criminal and civil proceedings as circumstantial evidence that they’ve had an abortion. Some people who have miscarriages could also be implicated, because “miscarriages are often conflated with induced abortions in the . . . law,” according to the Kaiser Family Foundation, and even insurers sometimes code them as such. These privacy concerns are set against the backdrop of newly restrictive abortion laws in many states.[1]
Such findings create legitimate concerns about how this data is being protected and how it synchronizes with consumers’ expectations. Reproductive health information is incredibly sensitive, amplifying the impact of poor data security and any resulting breaches and identity theft. Simply the collection and utilization of this information for targeted advertising can lead to emotional harms, heightened anxiety, and even impacts beyond that depending on who receives the information.
Given the sensitivity of this health information and the increasing collection of it outside the protective ambit of our medical confidentiality laws, this bills looks to expand CMIA to cover it.
This bill includes within the definition of “medical information” “reproductive or sexual health application information.” That term is defined as information about a consumer’s reproductive health, menstrual cycle, fertility, pregnancy, pregnancy outcome, plans to conceive, or type of sexual activity collected by a reproductive or sexual health digital service, including, but not limited to, information from which one can infer someone’s pregnancy status, menstrual cycle, fertility, hormone levels, birth control use, sexual activity, or gender identity.
This bill also deems a business that offers a reproductive or sexual health digital service to a consumer for the specific purpose of allowing them to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care and therefore subject to CMIA.
FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes
SUPPORT: (Verified 8/15/23)
Lieutenant Governor Eleni Kounalakis (source)
Attorney General Rob Bonta
Accessnow
Accountable Tech
ACLU California Action
American Association of University Women – California
American Association of University Women – San Jose
American College of Obstetricians and Gynecologists District IX
Anti-Defamation League
California Academy of Family Physicians
California Federation of Teachers
California Legislative Women's Caucus
California Nurse Midwives Association
California Pan - Ethnic Health Network
Center for Digital Democracy
City and County of San Francisco Department on the Status of Women
Consumer Federation of America
Consumer Reports
Demand Progress
Doctors in Politics
Eko Health
Electronic Frontier Foundation
Electronic Privacy Information Center
Equality California
Fairplay
Fight for the Future
Free Press
Friends of the Earth
GLAAD
Health Care Voices
Health Officers Association of California
Kairos
Mozilla
NARAL Pro-Choice California
National Association of Social Workers, California Chapter
Oakland Privacy
She Persisted
Sister Song
Super-majority
UltraViolet Action
Vote Pro Choice
OPPOSITION: (Verified 8/15/23)
None received
ARGUMENTS IN SUPPORT: Oakland Privacy states, “While it is empowering to have modern tools to get a better understanding of reproductive and sexual health, using these tools should not come at the expense of giving up privacy rights and being required to surrender sensitive health information. Furthermore, reproductive and sexual health digital products and service providers collect and share a lot of sensitive information and consumers don’t know and often can’t control who is accessing this data. Research has identified concerning practices with the collection, storage, selling and sharing of this sensitive reproductive and sexual health data. In addition, some entities have been found to use misleading privacy claims and predatory advertising practices. Consumers are left with a false sense of security that their data is private, safe and secure. AB 254 will give consumers an extra layer of protection and help with re-establishing trust in these digital services and products which is important now more than ever.”
ASSEMBLY FLOOR: 76-0, 5/22/23
AYES: Addis, Aguiar-Curry, Alanis, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Wendy Carrillo, Cervantes, Connolly, Megan Dahle, Davies, Dixon, Essayli, Flora, Mike Fong, Friedman, Gabriel, Gallagher, Garcia, Gipson, Grayson, Haney, Hart, Holden, Hoover, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, Mathis, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Jim Patterson, Joe Patterson, Pellerin, Petrie-Norris, Ramos, Reyes, Luz Rivas, Robert Rivas, Rodriguez, Blanca Rubio, Sanchez, Santiago, Schiavo, Soria, Ta, Ting, Valencia, Villapudua, Waldron, Wallis, Ward, Weber, Wicks, Wilson, Wood, Zbur, Rendon
NO VOTE RECORDED: Chen, Vince Fong, Lackey, Quirk-Silva
Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113
9/4/23 9:26:45
**** END ****
Catherine Roberts, These Period Tracker Apps Say They Put Privacy First. Here’s What We Found (May 25, 2022) Consumer Reports, https://www.consumerreports.org/health-privacy/period-tracker-apps-privacy-a2278134145/#:~:text=Overall%2C%20we%20recommend%20three%20of,researcher%20in%20CR's%20Digital%20Lab [as of Aug. 17, 2023]. ↑
SENATE RULES COMMITTEE Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 | AB 254 |
THIRD READING
Bill No: AB 254
Author: Bauer-Kahan (D), et al.
Amended: 8/17/23 in Senate
Vote: 21
SENATE JUDICIARY COMMITTEE: 9-0, 6/13/23
AYES: Umberg, Allen, Ashby, Caballero, Durazo, Laird, Min, Niello, Wiener
NO VOTE RECORDED: Wilk, Stern
SENATE HEALTH COMMITTEE: 11-1, 7/5/23
AYES: Eggman, Nguyen, Glazer, Gonzalez, Hurtado, Limón, Menjivar, Roth, Rubio, Wahab, Wiener
NOES: Grove
SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8
ASSEMBLY FLOOR: 76-0, 5/22/23 - See last page for vote
SUBJECT: Confidentiality of Medical Information Act: reproductive or sexual health application information
SOURCE: Lieutenant Governor Eleni Kounalakis
DIGEST:
This bill includes “reproductive or sexual health application information” in the definition of “medical information” and the businesses that offer reproductive or sexual health digital services to consumers in the definition of a provider of health care for purposes of the Confidentiality of Medical Information Act (CMIA).
Senate Floor Amendments of 8/17/23 replace certain terms referring to pregnancy outcomes in the definition of the relevant application information with simply “pregnancy outcome.”
ANALYSIS:
Existing federal law:
- Establishes the Health Insurance Portability and Accountability Act (HIPAA), which provides privacy protections for patients’ protected health information and generally prohibits a covered entity, as defined (health plan, health care provider, and health care clearing house), from using or disclosing protected health information except as specified or as authorized by the patient in writing. (45 C.F.R. § 164.500 et seq.)
- Provides that if HIPAA’s provisions conflict with a provision of state law, the provision that is the most protective of patient privacy prevails. (45 C.F.R. § 164.500 et seq.)
Existing state law:
- Provides, pursuant to the California Constitution, that all people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy. (Cal. Const., art. I, § 1.)
- Holds that the state constitution’s express right to privacy extends to an individual’s decision about whether or not to have an abortion. (People v. Belous (1969) 71 Cal.2d 954.)
- Establishes the CMIA, which establishes protections for the use of medical information. (Civ. Code § 56 et seq.)
- Prohibits providers of health care, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code § 56.10.)
- Defines “medical information,” for purposes of CMIA, to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental health application information, mental or physical condition, or treatment. (Civ. Code § 56.05(i).)
- Defines “provider of health care,” for purposes of CMIA, to mean any person licensed or certified pursuant to the Business and Professions Code, as specified; the Osteopathic Initiative Act or the Chiropractic Initiative Act; the Health and Safety Code, as specified; or any licensed clinic, health dispensary, or health facility, as specified. The term does not include insurance institutions, as defined. (Civ. Code § 56.05(o).)
This bill:
- Defines “reproductive or sexual health digital service” as a mobile-based application or internet website that collects reproductive or sexual health application information from a consumer, markets itself as facilitating reproductive or sexual health services to a consumer, and uses the information to facilitate reproductive or sexual health services to a consumer.
- Defines “reproductive or sexual health application information” as information about a consumer’s reproductive health, menstrual cycle, fertility, pregnancy, pregnancy outcome, plans to conceive, or type of sexual activity collected by a reproductive or sexual health digital service, including, but not limited to, information from which one can infer someone’s pregnancy status, menstrual cycle, fertility, hormone levels, birth control use, sexual activity, or gender identity.
- Includes reproductive or sexual health application information in the definition of “medical information” in CMIA.
- Provides that a business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of CMIA.
Background
Existing California and federal law strictly govern the use of a patient’s medical information. These statutory frameworks favor the privacy of the patient, with caveats for the sharing of medical information when necessary for treatment. California’s CMIA allows adult patients in California to keep personal health information confidential and decide whether and when to share that information. CMIA protects “medical information,” and restricts its disclosure by “providers of health care” and “health care service plans,” as defined and specified.
The use of digital health products and services that collect and transmit certain health data raises serious privacy concerns. Given the increasingly hostile environment around reproductive and gender-affirming healthcare, this bill addresses digital services that collect reproductive or sexual health information from consumers and that are offered by businesses for the purpose of allowing individuals to manage that information or even for diagnosis, treatment, or management of a medical condition. This bill deems the application information as medical information and the businesses offering them as providers of health care, bringing them within the protective ambit of CMIA.
This bill is sponsored by Lieutenant Governor Eleni Kounalakis and supported by various consumer and privacy groups, including the ACLU California Action. There is no known opposition. A more thorough discussion of this bill can be found in the Senate Judiciary Committee analysis, which is incorporated herein by reference.
Comments
- Author’s comments. According to the author:
Reproductive and sexual health information is clearly health information, and is particularly sensitive given the criminalization of almost any form of ending a pregnancy. Our current data protections do not speak to the sensitivity of this data. Apps and websites that explicitly market themselves as providing menstrual and pregnancy tracking are creating an expectation of healthcare and the associated privacy of information. Adding CMIA protections for these services is a critical and common sense step to ensure a sufficient baseline of privacy to protect consumers.
- Extending existing protections to reproductive or sexual health application information. The concern with reproductive or sexual health applications and online services is that while reproductive, or sexual health, information collected by a heath professional would be considered “medical information” and covered by existing medical privacy laws, because this information is being collected by apps and websites, meaning at the patient level and outside of a medical facility, it will not necessarily be captured under the existing definition of medical information.
The results of a Consumer Reports investigation frames the issue well:
If you use an app to track your menstrual cycle, you may enjoy the sometimes spot-on predictions about when your next period is coming. But your period-tracking app doesn’t just offer insight. It gathers a lot of data about you along the way, too—maybe even more than you know.
Period tracker apps collect deeply personal information that can include how often you have sex, whether you are trying to have a baby, if you get pregnant, and if you experience a miscarriage. When Consumer Reports last evaluated period tracker apps in 2020, our Digital Lab, which tests how well products and services protect consumers’ privacy, found that the five apps we evaluated—which all store users’ data in the cloud—provided no guarantee that this information would not be shared with third parties, even when users thought they were anonymous.
These lax privacy protections have long been a concern because users’ data can be used to target them with ads or even possibly to determine life insurance coverage or loan interest rates. Now that the Supreme Court has overturned Roe v. Wade—ending the constitutional right to an abortion—many app users may be newly worried that data about their fertility, missed periods, and more could be used against them in criminal and civil proceedings as circumstantial evidence that they’ve had an abortion. Some people who have miscarriages could also be implicated, because “miscarriages are often conflated with induced abortions in the . . . law,” according to the Kaiser Family Foundation, and even insurers sometimes code them as such. These privacy concerns are set against the backdrop of newly restrictive abortion laws in many states.[1]
Such findings create legitimate concerns about how this data is being protected and how it synchronizes with consumers’ expectations. Reproductive health information is incredibly sensitive, amplifying the impact of poor data security and any resulting breaches and identity theft. Simply the collection and utilization of this information for targeted advertising can lead to emotional harms, heightened anxiety, and even impacts beyond that depending on who receives the information.
Given the sensitivity of this health information and the increasing collection of it outside the protective ambit of our medical confidentiality laws, this bills looks to expand CMIA to cover it.
This bill includes within the definition of “medical information” “reproductive or sexual health application information.” That term is defined as information about a consumer’s reproductive health, menstrual cycle, fertility, pregnancy, pregnancy outcome, plans to conceive, or type of sexual activity collected by a reproductive or sexual health digital service, including, but not limited to, information from which one can infer someone’s pregnancy status, menstrual cycle, fertility, hormone levels, birth control use, sexual activity, or gender identity.
This bill also deems a business that offers a reproductive or sexual health digital service to a consumer for the specific purpose of allowing them to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care and therefore subject to CMIA.
FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes
SUPPORT: (Verified 8/15/23)
Lieutenant Governor Eleni Kounalakis (source)
Attorney General Rob Bonta
Accessnow
Accountable Tech
ACLU California Action
American Association of University Women – California
American Association of University Women – San Jose
American College of Obstetricians and Gynecologists District IX
Anti-Defamation League
California Academy of Family Physicians
California Federation of Teachers
California Legislative Women's Caucus
California Nurse Midwives Association
California Pan - Ethnic Health Network
Center for Digital Democracy
City and County of San Francisco Department on the Status of Women
Consumer Federation of America
Consumer Reports
Demand Progress
Doctors in Politics
Eko Health
Electronic Frontier Foundation
Electronic Privacy Information Center
Equality California
Fairplay
Fight for the Future
Free Press
Friends of the Earth
GLAAD
Health Care Voices
Health Officers Association of California
Kairos
Mozilla
NARAL Pro-Choice California
National Association of Social Workers, California Chapter
Oakland Privacy
She Persisted
Sister Song
Super-majority
UltraViolet Action
Vote Pro Choice
OPPOSITION: (Verified 8/15/23)
None received
ARGUMENTS IN SUPPORT: Oakland Privacy states:
While it is empowering to have modern tools to get a better understanding of reproductive and sexual health, using these tools should not come at the expense of giving up privacy rights and being required to surrender sensitive health information. Furthermore, reproductive and sexual health digital products and service providers collect and share a lot of sensitive information and consumers don’t know and often can’t control who is accessing this data. Research has identified concerning practices with the collection, storage, selling and sharing of this sensitive reproductive and sexual health data. In addition, some entities have been found to use misleading privacy claims and predatory advertising practices. Consumers are left with a false sense of security that their data is private, safe and secure. AB 254 will give consumers an extra layer of protection and help with re-establishing trust in these digital services and products which is important now more than ever.
ASSEMBLY FLOOR: 76-0, 5/22/23
AYES: Addis, Aguiar-Curry, Alanis, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Wendy Carrillo, Cervantes, Connolly, Megan Dahle, Davies, Dixon, Essayli, Flora, Mike Fong, Friedman, Gabriel, Gallagher, Garcia, Gipson, Grayson, Haney, Hart, Holden, Hoover, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, Mathis, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Jim Patterson, Joe Patterson, Pellerin, Petrie-Norris, Ramos, Reyes, Luz Rivas, Robert Rivas, Rodriguez, Blanca Rubio, Sanchez, Santiago, Schiavo, Soria, Ta, Ting, Valencia, Villapudua, Waldron, Wallis, Ward, Weber, Wicks, Wilson, Wood, Zbur, Rendon
NO VOTE RECORDED: Chen, Vince Fong, Lackey, Quirk-Silva
Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113
8/23/23 14:32:57
**** END ****
Catherine Roberts, These Period Tracker Apps Say They Put Privacy First. Here’s What We Found (May 25, 2022) Consumer Reports, https://www.consumerreports.org/health-privacy/period-tracker-apps-privacy-a2278134145/#:~:text=Overall%2C%20we%20recommend%20three%20of,researcher%20in%20CR's%20Digital%20Lab [as of Aug. 17, 2023]. ↑
SENATE COMMITTEE ON HEALTH
Senator Dr. Susan Talamantes Eggman, Chair
BILL NO: AB 254
AUTHOR: | Bauer-Kahan | ||
VERSION: | April 17, 2023 | ||
HEARING DATE: | July 5, 2023 | ||
CONSULTANT: | Melanie Moreno | ||
SUBJECT: Confidentiality of Medical Information Act: reproductive or sexual health application information
SUMMARY:
Adds “reproductive or sexual health application information” in the definition of “medical information” in the Confidentiality of Medical Information Act.
Existing federal law: Establishes the Health Insurance Portability and Accountability Act (HIPAA), which provides privacy protections for patients’ protected health information and generally prohibits a covered entity, as defined (health plan, health care provider, and health care clearing house), from using or disclosing protected health information except as specified or as authorized by the patient in writing. Provides that if HIPAA’s provisions conflict with a provision of state law, the provision that is the most protective of patient privacy prevails. [45 CFR §164.500, et seq.]
Existing state law:
- Establishes the Confidentiality of Medical Information Act (CMIA), which prohibits a health care provider, health care service plan, or contractor from disclosing medical information regarding a patient without first obtaining authorization. [CIV §56, et. seq.]
- Defines “medical information,” for purposes of the CMIA, as any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. [CIV §56.05(i)]
- Defines “provider of health care,” for purposes of the CMIA, as any licensed or certified health care provisional, and any clinic, health dispensary, or health facility, as specified. [CIV §56.05(o)]
- Requires any business organized for the purposes of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for the purposes of allowing the individual to manage his or her information, or for the diagnosis or treatment of the individual, to be deemed a provider of health care subject to the CMIA. [CIV §56.06(a)]
- Requires any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be deemed a provider of health care subject to the CMIA. [CIV 56.06(b)]
- Requires, as part of the CMIA, that any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of written or electronic medical records, to be subject to damages in a civil action or an administrative fine, as specified. [CIV §56.36]
This bill:
- Adds “reproductive or sexual health application information” in the definition of “medical information” in CMIA. Deems any business that offers a “reproductive or sexual health digital service” to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, as a provider of health care subject to the CMIA. Prohibits this from being construed to make a business a provider of health care for purposes of any law other than the CMIA, as specified.
- Defines “reproductive or sexual health application information” as information about a consumer’s reproductive health, menstrual cycle, fertility, pregnancy, miscarriage, pregnancy termination, plans to conceive, or type of sexual activity collected by a reproductive or sexual health digital service, including, but not limited to, information from which one can infer someone’s pregnancy status, menstrual cycle, fertility, hormone levels, birth control use, sexual activity, or gender identity.
- Defines “reproductive or sexual health digital service” as a mobile-based application or internet website that collects reproductive or sexual health application information from a consumer, markets itself as facilitating reproductive or sexual health services to a consumer, and uses the information to facilitate reproductive or sexual health services to a consumer.
FISCAL EFFECT:
According to the Assembly Appropriations Committee, no direct costs.
PRIOR VOTES:
Senate Judiciary Committee: | 9 – 0 |
Assembly Floor: | 76 - 0 |
Assembly Appropriations Committee: | 15 - 0 |
Assembly Privacy and Consumer Protection: | 10 - 0 |
Assembly Health Committee: | 13 - 0 |
COMMENTS:
- Author’s statement. According to the author, reproductive and sexual health information is clearly health information, and is particularly sensitive given the criminalization of almost any form of ending a pregnancy. Our current data protections do not speak to the sensitivity of this data. Apps and websites that explicitly market themselves as providing menstrual and pregnancy tracking are creating an expectation of healthcare and the associated privacy of information. Adding CMIA protections for these services is a critical and common sense step to ensure a sufficient baseline of privacy to protect consumers.
- Medical privacy laws. In general, patient protections of medical information fall under two main bodies of law: HIPAA in federal law and the CMIA in California. HIPAA provides federal protections for patient’s health information held by covered entities and any business associates that a covered entity engages to help it carry out its health care activities. A covered entity can be a provider, a health plan, or a health care clearinghouse that processes health information it receives from another entity. While HIPAA establishes a federal floor for minimum privacy protections and the right of patients to access their health information, states are permitted to enact laws that provide greater privacy protections or rights. Under the CMIA, a health care provider, health care service plan, or contractor cannot disclose medical information regarding a patient without getting the patient’s written authorization.
- Reproductive and sexual health apps. According to a June 24, 2022 report by National Public Radio (NPR), millions of people use apps to help track their menstrual cycles. Flo, which bills itself as the most popular period and cycle tracking app, has 43 million active users. Clue (another app) claims 12 million monthly active users. The personal health data stored in these apps is among the most intimate types of information a person can share; the apps can show when a person’s period stops and starts and when a pregnancy stops and starts. According to the NPR report, in the wake of the Supreme Court's decision to overturn Roe v. Wade, privacy experts are increasingly concerned about how data collected from period-tracking apps, among others, could potentially be used to penalize anyone seeking or considering an abortion.
Nonprofit Mozilla Foundation (a supporter of this bill) published a study in August 2022 of the most popular reproductive health apps, and found that 18 out of 25 had data collection practices that raised privacy or security concerns. Mozilla researched ten period tracking apps, ten pregnancy tracking apps, and five health and fitness wearable devices that track fertility, including Flo, Glow, Ovia, Period Calendar Period Tracker, and My Calendar Period Tracker. According to Mozilla, these apps collect huge amounts of data, and that data rarely stays in one place - it circulates, bouncing from one entity to the other, including third-party businesses and research institutions. The majority of the apps studied did not provide clear guidelines on what data could be shared with law enforcement. Consumer Reports (also a supporter of this bill) evaluated period tracker apps in 2020 and again in 2022 and found that the apps, most of which store users’ data in the cloud, provided no guarantee that this information would not be shared with third parties, even when users thought they were anonymous. Only one app evaluated with over 100,000 installs (Fertility Friend) didn’t have third party trackers, and three others (Drip, Euki, and Periodical) store data locally and don’t allow third party tracking. The Consumer Reports article states that with the Supreme Court decision to overturn Roe v. Wade, many app users may be worried that data about their fertility and missed periods could be used against them in criminal and civil proceedings as circumstantial evidence that they’ve had an abortion. Some people who have miscarriages could also be implicated, because “miscarriages are often conflated with induced abortions in the . . . law,” according to the Kaiser Family Foundation. Consumer Reports digital privacy and security experts say lawmakers could help more broadly by enacting stronger privacy laws that limit what companies can collect and share about people.
- Double referral. This bill passed the Senate Judiciary Committee by a vote of 9-0 on June 13, 2023.
- Related legislation. AB 352 (Bauer-Kahan) requires specified businesses that electronically store or maintain medical information on the provision of sensitive services, as specified, to enable certain security features, including limiting user access privileges and segregating medical information related to sensitive services, as specified. AB 352 prohibits a health care provider, health plan, contractor, or employer from cooperating with any inquiry or investigation by, or from providing medical information to, an individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual or that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful, unless authorized. AB 352 is set to be heard in this Committee on July 12, 2023.
- Prior legislation. AB 2089 (Bauer-Kahan, Chapter 690, Statutes of 2022) includes mental health application information in the definition of “medical information” and the businesses that offer mental health digital services to consumers in the definition of a provider of health care for purposes of CMIA.
AB 2091 (Bonta, Chapter 628, Statutes of 2022) establishes requirements to protect the private information of individuals who seek or consider an abortion.
AB 1252 (Chau of 2021) and AB 1436 (Chau of 2021) would have deemed any business a provider of health care subject to the requirements of the CMIA if that business offers software or hardware to a consumer, including a mobile application or related device, that is designed to maintain personal health information in order to make information available to an individual or to a provider of health care for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual. AB 1252 died on the Assembly Floor inactive file. AB 1436 was held on the Senate Appropriations Committee suspense file.
AB 2280 (Chau of 2020) would have defined “personal health record” as a commercial website, online service, or product that is used by an individual that collects individually identifiable personal health record information to ensure that the CMIA applies to information derived from or in the possession of these systems. AB 2280 was not heard in the Senate Judiciary Committee.
AB 2167 (Chau of 2018) would have amended the CMIA to include within the definition of “medical information” any information in possession of, or derived from, a digital health feedback system. AB 2167 would have required manufacturers or operators that sell devices or applications that may be used as part of these digital health feedback systems to equip them with reasonable security features, as specified. AB 2167 failed passage on the Senate Floor.
AB 375 (Chau, Chapter 55, Statutes of 2018) provides consumers the right to access their personal information that is collected by a business, the right to delete it, the right to know what personal information is collected, the right to know whether and what personal information is being sold or disclosed, the right to stop a business from selling their information, and the right to equal service and price, with certain exceptions. AB 375 provides a modified, private right of action for data breaches and allows for enforcement by the Attorney General for other violations with a right to cure for businesses in violation, as specified.
AB 2747 (Assembly Committee on Judiciary, Chapter 913, Statutes of 2014) extends CMIA provisions to any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care.
AB 658 (Calderon, Chapter 296, Statutes of 2013) applies the prohibitions of CMIA to any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information to allow an individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual.
AB 1298 (Jones, Chapter 699, Statutes of 2007) subjected any business organized to maintain medical information for purposes of making that information available to an individual or to a health care provider, as specified, to the provisions of the CMIA.
- Support. The American College of Obstetricians and Gynecologists District IX states that since the overturn of Roe v. Wade, 11 states have criminalized abortion, and many more are considering doing the same. With this cause comes the effect that app users could face criminal punishment for inputting their information on an app. Current privacy laws do not adequately protect the sensitive information collected by reproductive or sexual health apps. The privacy expansion proposed in this bill is a vital and necessary component to protect consumer’s personal health data, protect privacy, and reduce the potential of facing discrimination harms. The Health Officers Association of California writes that ensuring the confidentiality of this information is essential to respect and protect individuals’ privacy rights. Confidentiality is crucial in creating a safe environment where users can freely explore and address their reproductive and sexual health concerns without the fear of stigma or discrimination. If the information stored is not confidential, it can also jeopardize users’ personal safety. The California Pan-Ethnic Health Network (CPEHN) states that this bill will ensure that users can be assured that sensitive digital information about their reproductive and sexual health will have the same protections and privacy as their medical information. Thus, this bill will create continuous data protection across health platforms for abortion and gender-affirming care. CPEHN believes that this bill will increase not only privacy and protection but also equitable and safe access for communities of color who request sexual reproductive health services digitally. Oakland Privacy writes that this bill will provide the express inclusion of privacy protections of reproductive and sexual health digital products and services under the CMIA. This privacy expansion is a vital and necessary component to protect consumer's personal health data, protect privacy, and reduce the potential of facing discrimination harms.
SUPPORT AND OPPOSITION:
Support: Lieutenant Governor Eleni Kounalakis (sponsor)
Access Now
Accountable Tech
American Association of University Women California
American Association of University Women San Jose Branch
American Civil Liberties Union California Action
American College of Obstetricians and Gynecologists District IX
Anti-Defamation League
Attorney General Rob Bonta
California Legislative Women’s Caucus
California Academy of Family Physicians
California Federation of Teachers
California Nurse Midwives Association
California Pan-Ethnic Health Network
Center for Digital Democracy
City and County of San Francisco Department on the Status of Women
City and County of San Francisco Office of the City Attorney
Consumer Federation of America
Consumer Reports
Demand Progress
Doctors in Politics
Eko
Electronic Frontier Foundation
Electronic Privacy Information Center
Equality California
Fairplay
Fight for the Future
Free Press Action
Friends of the Earth
GLAAD
Health Care Voices
Health Officers Association of California
Kairos Action
Mozilla
NARAL Pro-choice California
National Association of Social Workers, California Chapter
Oakland Privacy
#ShePersisted
Sister Song: National Women of Color Reproductive Justice Collective
Supermajority
UltraViolet Action
VoteProChoice
Oppose: None received
-- END --
Senator Thomas Umberg, Chair
2023-2024 Regular Session
Bill No: AB 254 (Author:Bauer-Kahan)
Version: April 17, 2023
Hearing Date: June 13, 2023
Fiscal: Yes
Urgency: No
Consultant: CK
SUBJECT
Confidentiality of Medical Information Act: reproductive or sexual health application information
DIGEST
This bill includes “reproductive or sexual health application information” in the definition of “medical information” and the businesses that offer reproductive or sexual health digital services to consumers in the definition of a provider of health care for purposes of the Confidentiality of Medical Information Act (CMIA).
EXECUTIVE SUMMARY
Existing California and federal law strictly govern the use of a patient’s medical information. These statutory frameworks favor the privacy of the patient, with caveats for the sharing of medical information when necessary for treatment. California’s CMIA allows adult patients in California to keep personal health information confidential and decide whether and when to share that information. CMIA protects “medical information,” and restricts its disclosure by “providers of health care” and “health care service plans,” as defined and specified.
The use of digital health products and services that collect and transmit certain health data raises serious privacy concerns. Given the increasingly hostile environment around reproductive and gender-affirming healthcare, this bill addresses digital services that collect reproductive or sexual health information from consumers and that are offered by businesses for the purpose of allowing individuals to manage that information or even for diagnosis, treatment, or management of a medical condition. The bill deems the application information as medical information and the businesses offering them as providers of health care, bringing them within the protective ambit of CMIA.
The bill is author-sponsored and supported by various consumer and privacy groups, including ACLU California Action. There is no known opposition. If the bill passes this Committee, it will then go to the Senate Health Committee.
PROPOSED CHANGES TO THE LAW
Existing federal law:
- Establishes the Health Insurance Portability and Accountability Act (HIPAA), which provides privacy protections for patients’ protected health information and generally prohibits a covered entity, as defined (health plan, health care provider, and health care clearing house), from using or disclosing protected health information except as specified or as authorized by the patient in writing. (45 C.F.R. § 164.500 et seq.)
- Provides that if HIPAA’s provisions conflict with a provision of state law, the provision that is the most protective of patient privacy prevails. (45 C.F.R. § 164.500 et seq.)
Existing state law:
- Provides, pursuant to the California Constitution, that all people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy. (Cal. Const., art. I, § 1.)
- Holds that the state constitution’s express right to privacy extends to an individual’s decision about whether or not to have an abortion. (People v. Belous (1969) 71 Cal.2d 954.)
- Establishes the CMIA, which establishes protections for the use of medical information. (Civ. Code § 56 et seq.)
- Prohibits providers of health care, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code § 56.10.)
- Provides that every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall do so in a manner that preserves the confidentiality of the information contained therein. Any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall be subject to remedies and penalties, as specified. (Civ. Code § 56.101.)
- Defines “patient,” for purposes of CMIA, to mean any natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains. (Civ. Code § 56.05(l).)
- Defines “medical information,” for purposes of CMIA, to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental health application information, mental or physical condition, or treatment. “Individually identifiable” means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individual’s identity. (Civ. Code § 56.05(i).)
- Defines “provider of health care,” for purposes of CMIA, to mean any person licensed or certified pursuant to the Business and Professions Code, as specified; the Osteopathic Initiative Act or the Chiropractic Initiative Act; the Health and Safety Code, as specified; or any licensed clinic, health dispensary, or health facility, as specified. The term does not include insurance institutions, as defined. (Civ. Code § 56.05(o).)
- Provides that any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of CMIA. (Civ. Code § 56.06(a).)
- Provides that any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of CMIA. (Civ. Code § 56.06(b).)
- Provides that any business that is licensed pursuant to the Medicinal and Adult-Use Cannabis Regulation and Safety Act that is authorized to receive or receives identification cards or information contained in a physician’s recommendation, as provided, shall be deemed to be a provider of health care subject to the requirements of CMIA. (Civ. Code § 56.06(c).)
- Provides that any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of CMIA. (Civ. Code § 56.06(d).)
- Provides that any business described in the preceding three paragraphs must maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business. Such businesses are subject to the penalties for improper use and disclosure of medical information prescribed in CMIA. (Civ. Code § 56.06(e)-(f).)
- Provides that any provider of health care, a health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of written or electronic medical records shall be subject to damages in a civil action or an administrative fine, as specified. (Civ. Code § 56.36.)
- Establishes the Reproductive Privacy Act, which provides that the Legislature finds and declares that every individual possesses a fundamental right of privacy with respect to personal reproductive decisions and, therefore, it is the public policy of the State of California that:
- every individual has the fundamental right to choose or refuse birth control; and
- every individual has the fundamental right to choose to bear a child or to choose to obtain an abortion, with specified limited exceptions.
- Specifies, under the Insurance Information and Privacy Protection Act, requirements insurers must take to protect the confidentiality of an insured’s medical information. (Ins. Code § 791.29 et. seq.)
- Requires a health insurer to recognize the right of a protected individual to exclusively exercise rights regarding medical information related to sensitive services that the protected individual has received, including reproductive health services. (Ins. Code § 791.29 (a)(2).)
- Prohibits a health insurer from disclosing medical information about sensitive health care services provided to a protected individual to the policyholder or any insureds other than the protected individual receiving care, absent written authorization of the protected individual receiving care. (Id. (a)(4).)
This bill:
- Defines “reproductive or sexual health digital service” as a mobile-based application or internet website that collects reproductive or sexual health application information from a consumer, markets itself as facilitating reproductive or sexual health services to a consumer, and uses the information to facilitate reproductive or sexual health services to a consumer.
- Defines “reproductive or sexual health application information” as information about a consumer’s reproductive health, menstrual cycle, fertility, pregnancy, miscarriage, pregnancy termination, plans to conceive, or type of sexual activity collected by a reproductive or sexual health digital service, including, but not limited to, information from which one can infer someone’s pregnancy status, menstrual cycle, fertility, hormone levels, birth control use, sexual activity, or gender identity.
- Includes reproductive or sexual health application information in the definition of “medical information” in CMIA.
- Provides that a business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of CMIA.
COMMENTS
- Protections for medical information
HIPAA, enacted in 1996, guarantees privacy protection for individuals with regards to specific health information. (Pub.L. 104–191, 110 Stat. 1936.) Generally, protected health information is any information held by a covered entity which concerns health status, provision of healthcare, or payment for healthcare that can be connected to an individual. HIPAA privacy regulations require healthcare providers and organizations to develop and follow procedures that ensure the confidentiality and security of personal health information when it is transferred, received, handled, or shared. HIPAA further requires reasonable efforts when using, disclosing, or requesting protected health information to limit disclosure of that information to the minimum amount necessary to accomplish the intended purpose.
CMIA (Civ. Code § 56 et seq.) allows adult patients in California to keep personal health information confidential and decide whether and when to share that information. These provisions seek to protect Californians’ fundamental right to privacy. (Cal. Const., art. I, § 1.) CMIA protects “medical information,” and generally regulates what providers of health care and health care service plans can do with such information.
- Extending existing protections to reproductive or sexual health application information
The COVID-19 pandemic has arguably fundamentally altered our society and the health care system. While there was already a trend toward Californians and health care professionals relying on digital health products and services, the pandemic has expedited the process.
One particular area this is occurring in is reproductive health care. The concern with such tools is that while reproductive, or sexual health, information collected by a heath professional would be considered “medical information” and covered by existing medical privacy laws, because this information is being collected by apps and websites, meaning at the patient level and outside of a medical facility, it will not necessarily be captured under the existing definition of medical information.
The results of a Consumer Reports investigation frames the issue well:
If you use an app to track your menstrual cycle, you may enjoy the sometimes spot-on predictions about when your next period is coming. But your period-tracking app doesn’t just offer insight. It gathers a lot of data about you along the way, too—maybe even more than you know.
Period tracker apps collect deeply personal information that can include how often you have sex, whether you are trying to have a baby, if you get pregnant, and if you experience a miscarriage. When Consumer Reports last evaluated period tracker apps in 2020, our Digital Lab, which tests how well products and services protect consumers’ privacy, found that the five apps we evaluated—which all store users’ data in the cloud—provided no guarantee that this information would not be shared with third parties, even when users thought they were anonymous.
These lax privacy protections have long been a concern because users’ data can be used to target them with ads or even possibly to determine life insurance coverage or loan interest rates. Now that the Supreme Court has overturned Roe v. Wade—ending the constitutional right to an abortion—many app users may be newly worried that data about their fertility, missed periods, and more could be used against them in criminal and civil proceedings as circumstantial evidence that they’ve had an abortion. Some people who have miscarriages could also be implicated, because “miscarriages are often conflated with induced abortions in the . . . law,” according to the Kaiser Family Foundation, and even insurers sometimes code them as such. These privacy concerns are set against the backdrop of newly restrictive abortion laws in many states.[1]
Such findings create legitimate concerns about how this data is being protected and how it synchronizes with consumers’ expectations. Reproductive health information is incredibly sensitive, amplifying the impact of poor data security and any resulting breaches and identity theft. Simply the collection and utilization of this information for targeted advertising can lead to emotional harms, heightened anxiety, and even impacts beyond that depending on who receives the information.
As stated, this all occurs in a frightening climate for reproductive rights. Roe v. Wade (1973) 410 U.S. 113, was the landmark U.S. Supreme Court decision that held the implied constitutional right to privacy extended to a person’s decision whether to terminate a pregnancy, while allowing that some state regulation of abortion access could be permissible. Roe has been one of the most debated U.S. Supreme Court decisions and its application and validity have been challenged numerous times, but its fundamental holding had continuously been upheld by the Court until June 2022. On June 24, 2022, the Court published its official opinion in Dobbs and voted 6-3 to overturn the holding in Roe.[2] The majority opinion upholds the Mississippi law finding that, contrary to almost 50 years of precedent, there is no fundamental constitutional right to have an abortion. The opinion further provides that states should be allowed to decide how to regulate abortion and that a strong presumption of validity should be afforded to those state laws.[3]
The Roe decision was the foundation for allowing people the ability to control their reproductive lives because it established a federal constitutional right for anyone who could become pregnant in the United States to decide when and if to have children and prevented the criminalization of having an abortion or providing an abortion. Prior to Roe, legal abortion did exist in some states, but the choices available to those seeking to terminate an unwanted pregnancy were limited and disproportionately affected those who were younger, lower income, and members of communities of color.[4] In the wake of the Dobbs decision, it is very probable that abortion will be banned or severely restricted in dozens of states,[5] with 13 states already having total abortion bans in effect.[6] Almost one-third of women and people who can become pregnant of reproductive age in the United States live in a state where abortion is not legal or is severely restricted.[7] If all the states expected to enact a total ban on abortion actually do, the number of patients who would find that their nearest clinic is in California could increase to 1.4 million, an almost 3,000 percent increase.[8] These increased attacks on reproductive freedom in this country only make the privacy concerns regarding reproductive health information all the more urgent.
In addition, as California and other states have implemented policies to ensure that transgender individuals are not discriminated against and can obtain gender-affirming care, other states have targeted transgender individuals and providers of gender-affirming care. According to Human Rights Watch, as of March 2022, legislatures nationwide had introduced over 300 anti-LGBTQ+ bills, over 130 of which specifically targeted transgender people.[9] Many states have been enacting statutes that potentially impose civil and criminal liability for providing to a minor, or helping a minor obtain, gender-affirming care. For example, Alabama recently enacted a bill that makes it a felony to provide, or help to provide, certain types of gender-affirming care.[10] Arkansas prohibits a physician or other healthcare provider from providing or referring certain types of gender-affirming care for a minor; a violation or “threatened violation” can be punished through a professional board or a civil action.[11] Thus, data collected by digital service providers online and through applications that may reveal one’s gender identity, sexual activity, or their searches for gender-affirming care become increasingly sensitive as many corners of the country criminalize it.
Legislation is arguably needed to strike an appropriate balance between broadened access to reproductive and sexual health information and services for the public good and protection of the fundamental right to privacy. Given the sensitivity of this health information and the increasing collection of it outside the protective ambit of our medical confidentiality laws, this bills looks to expand CMIA to cover it.
The bill includes within the definition of “medical information” “reproductive or sexual health application information.” That term is defined as information about a consumer’s reproductive health, menstrual cycle, fertility, pregnancy, miscarriage, pregnancy termination, plans to conceive, or type of sexual activity collected by a reproductive or sexual health digital service, including, but not limited to, information from which one can infer someone’s pregnancy status, menstrual cycle, fertility, hormone levels, birth control use, sexual activity, or gender identity.
The bill also deems a business that offers a reproductive or sexual health digital service to a consumer for the specific purpose of allowing them to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, a provider of health care and therefore subject to CMIA.
This inclusion creates guardrails that are arguably necessary to protect this privately-collected but particularly sensitive information that consumers likely expect to be kept confidential. Providers of health care are subject to various requirements under CMIA. They are prohibited from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code § 56.10.) A provider of health care who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information is required to do so in a manner that preserves the confidentiality of the information contained therein. Any provider of health care who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information is subject to certain penalties. (Civ. Code § 56.101.) If a provider negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of written or electronic medical records, they are subject to damages in a civil action or an administrative fine, as specified. (Civ. Code § 56.36.)
- Building on previous legislation
This bill models several predecessor bills. AB 658 (Calderon, Ch. 296, Stats. 2013) responded to other digital tools entering the healthcare space. Similar to this bill, AB 658 was motivated by privacy concerns connected to internet-based applications that allowed individuals to gather, store, manage, and in some cases share, personal health information. It inserted the following provision into CMIA:
Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (g) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, nothing in this section shall be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
The provision applies to software or hardware that maintains “medical information,” as defined in CMIA. The definition is limited to information “in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor.”
Last year, AB 2089 (Bauer-Kahan, Ch. 690, Stats. 2022) provided similar protections to this bill but for mental health application information that related to a consumer’s inferred or diagnosed mental health or substance use disorder.
- Stakeholder positions
According to the author:
Reproductive and sexual health information is clearly health information, and is particularly sensitive given the criminalization of almost any form of ending a pregnancy. Our current data protections do not speak to the sensitivity of this data. Apps and websites that explicitly market themselves as providing menstrual and pregnancy tracking are creating an expectation of healthcare and the associated privacy of information. Adding CMIA protections for these services is a critical and common sense step to ensure a sufficient baseline of privacy to protect consumers.
Writing in support, Oakland Privacy states:
While it is empowering to have modern tools to get a better understanding of reproductive and sexual health, using these tools should not come at the expense of giving up privacy rights and being required to surrender sensitive health information. Furthermore, reproductive and sexual health digital products and service providers collect and share a lot of sensitive information and consumers don’t know and often can’t control who is accessing this data. Research has identified concerning practices with the collection, storage, selling and sharing of this sensitive reproductive and sexual health data. In addition, some entities have been found to use misleading privacy claims and predatory advertising practices. Consumers are left with a false sense of security that their data is private, safe and secure. AB 254 will give consumers an extra layer of protection and help with re-establishing trust in these digital services and products which is important now more than ever.
NARAL Pro-Choice California urges support for the bill: “At a time when reproductive health care is under threat this bill would urge businesses to take action to preserve reproductive freedom.”
SUPPORT
accessnow
Accountable Tech
ACLU California Action
ADL
American Association of University Women – California
American Association of University Women – San Jose
American College of Obstetricians and Gynecologists District IX
California Legislative Women's Caucus
California Academy of Family Physicians
California Federation of Teachers
California Nurse Midwives Association (CNMA)
California Pan - Ethnic Health Network
Center for Digital Democracy
City and County of San Francisco Department on the Status of Women
Consumer Federation of America
Consumer Reports
Demand Progress
Doctors In Politics
EKO
Electronic Frontier Foundation
epic.org
Fairplay
Fight For The Future
Free Press
Friends of the Earth
glaad
Health Care Voices
Health Officers Association of California
KAIROS
Mozilla
NARAL Pro-Choice California
National Association of Social Workers, California Chapter
Oakland Privacy
She Persisted
Sister Song
Super-majority
ultraviolet Action
Vote Pro Choice
OPPOSITION
None known
RELATED LEGISLATION
Pending Legislation:
AB 352 (Bauer-Kahan, 2023) requires specified businesses that electronically store or maintain medical information on the provision of sensitive services, as specified, on or before July 1, 2024, to enable certain security features, including limiting user access privileges and segregating medical information related to sensitive services, as specified. It prohibits a health care provider, health care service plan, contractor, or employer from cooperating with any inquiry or investigation by, or from providing medical information to, an individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual or that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless authorized. AB 352 is currently pending referral in the Senate.
AB 793 (Bonta, 2023) prohibits a government entity from seeking or obtaining information from a reverse-location demand or a reverse-keyword demand, and prohibits any person or government entity from complying with a reverse-location demand or a reverse-keyword demand. AB 793 is currently pending referral in the Senate.
AB 1194 (Wendy Carrillo, 2023) amends the California Consumer Privacy Act to ensure that businesses comply with the obligations imposed by the Act when consumer data contains information related to accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care, including abortion services. AB 1194 is currently in this Committee.
Prior Legislation:
AB 1242 (Bauer-Kahan, Ch. 627, Stats. 2022) prohibits law enforcement from knowingly arresting a person for performing or aiding in the performance of a lawful abortion or for obtaining an abortion and prohibits specified entities from providing information to another state or political subdivision thereof regarding an abortion that is lawful under California law, except as provided.
AB 2089 (Bauer-Kahan, Ch. 690, Stats. 2022) See Comment 3.
AB 2091 (Mia Bonta, Ch. 628, Stats. 2022), among other things, prohibited compelling a person to identify or provide information that would identify an individual who has sought or obtained an abortion in a state, county, city, or other local criminal, administrative, legislative, or other proceeding if the information is being requested based on another state’s laws that interfere with a person’s right to choose or obtain an abortion or a foreign penal civil action.
AB 1436 (Chau, 2021) would have prohibited a business that offers a “personal health record system” from knowingly using or disclosing the “personal health record information” of a person without first obtaining a signed authorization, as specified. This bill died in the Senate Appropriations Committee.
AB 1252 (Chau, 2021) would have revised CMIA to define personal health record (PHR) and personal health record information, and deem a business that offers PHR software or hardware to a consumer, as specified, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be a “health care provider” subject to the requirements of CMIA. This bill died on the Assembly Floor.
AB 384 (Chau, 2019) would have defined “personal health record” as an FDA-approved commercial internet website, online service, or product that is used by an individual at the direction of a provider of health care with the primary purpose of collecting the individual’s individually identifiable personal health record information. This would have ensured that CMIA applied to information derived from or in the possession of these systems. AB 384 died in the Senate Appropriations Committee.
SB 327 (Jackson, Ch. 886, Stats. 2018) required manufacturers of connected devices to equip those devices with reasonable security features appropriate to the nature of the device.
AB 2167 (Chau, 2018) would have amended CMIA to include within the definition of “medical information” any information in possession of, or derived from, a digital health feedback system. This bill failed passage on the Senate Floor.
AB 658 (Calderon, Ch. 296, Stats. 2013) See Comment 3.
AB 1298 (Jones, Ch. 699, Stats. 2007) subjected any business organized to maintain medical information for purposes of making that information available to an individual or to a health care provider, as specified, to the provisions of CMIA.
PRIOR VOTES:
Assembly Floor (Ayes 76, Noes 0)
Assembly Appropriations Committee (Ayes 15, Noes 0)
Assembly Privacy and Consumer Protection Committee (Ayes 10, Noes 0)
Assembly Health Committee (Ayes 13, Noes 0)
**************
Catherine Roberts, These Period Tracker Apps Say They Put Privacy First. Here’s What We Found (May 25, 2022) Consumer Reports, https://www.consumerreports.org/health-privacy/period-tracker-apps-privacy-a2278134145/#:~:text=Overall%2C%20we%20recommend%20three%20of,researcher%20in%20CR's%20Digital%20Lab. All internet citations are current as of June 9, 2023. ↑
Dobbs v. Jackson Women’s Health (2022) 597 U.S. _ (142 S.Ct. 2228) at p. 5, https://www.supremecourt.gov/opinions/21pdf/19-1392_6j37.pdf. ↑
Id. at 77. ↑
Rachel Benson Gold, Lessons from Before Roe: Will Past be Prologue, Guttmacher Institute (Mar. 1, 2003), https://www.guttmacher.org/gpr/2003/03/lessons-roe-will-past-be-prologue. ↑
Elizabeth Nash and Isabel Guarnieri, Six Months Post-Roe, 24 US States Have Banned Abortion or Are Likely to Do So: A Roundup, Guttmacher Institute (Jan. 10, 2023) https://www.guttmacher.org/2023/01/six-months-post-roe-24-us-states-have-banned-abortion-or-are-likely-do-so-roundup. ↑
Sharon Bernstein, Factbox: US. abortion restrictions mount after overturn of Roe v. Wade, Reuters, (Oct. 4, 2022), available at https://www.reuters.com/business/healthcare-pharmaceuticals/us-abortion-restrictions-mount-after-overturn-roe-v-wade-2022-10-04/#:~:text=ACTIVE%20BANS,an%20abortion%20rights%20research%20group. ↑
Katie Shepherd, Rachel Roubein, and Caroline Kitchner, 1 in 3 American women have already lost abortion access. More restrictive laws are coming, The Washington Post, (Aug. 22, 2022) https://www.washingtonpost.com/nation/2022/08/22/more-trigger-bans-loom-1-3-women-lose-most-abortion-access-post-roe/. ↑
April Dembosky, As states ban abortion, Californians open their arms and wallets, NPR (June 27, 2022), https://www.npr.org/sections/health-shots/2022/06/27/1103479722/as-states-ban-abortion-californians-open-their-arms-and-wallets. ↑
Human Rights Watch, Press Release, ICYMI: As Lawmakers Escalate Attacks on Transgender Youth Across the Country, Some GOP Leaders Stand Up for Transgender Youth (Mar. 24, 2022), https://www.hrc.org/press-releases/icymi-as-lawmakers-escalate-attacks-on-transgender-youth-across-the-country-some-gop-leaders-stand-up-for-transgender-youth. ↑
See Al. Code, § 26-26-4. ↑
Ark. Stats. §§ 20-9-1502 & 20-9-1504. ↑
ASSEMBLY THIRD READING
ATR Bill Id:AB 254
Author:(Bauer-Kahan)
As Amended Ver:April 17, 2023
Majority vote
SUMMARY
Revises the Confidentiality of Medical Information Act (CMIA) to include reproductive or sexual health application information into the definition of medical information. Defines reproductive or sexual health application information to mean information about a consumer's reproductive health, menstrual cycle, fertility, pregnancy, miscarriage, pregnancy termination, plans to conceive, or type of sexual activity collected by a reproductive or sexual health digital service, including, but not limited to, information from which one can infer someone's pregnancy status, menstrual cycle, fertility, hormone levels, birth control use, sexual activity, or gender identity. Defines reproductive or sexual health digital service to mean a mobile-based application or internet website that collects reproductive or sexual health application information from a consumer, markets itself as facilitating reproductive or sexual health services to a consumer, and uses the information to facilitate reproductive or sexual health services to a consumer. Deems a business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individual's information, or for the individual's diagnosis, treatment, or management of a medical condition, to be a provider of health care, as specified.
Major Provisions
COMMENTS
Reproductive and sexual health information is clearly health information, and is particularly sensitive given the criminalization of almost any form of ending a pregnancy. The author points out that current data protections do not speak to the sensitivity of this data. Apps and websites that explicitly market themselves as providing menstrual and pregnancy tracking are creating an expectation of healthcare and the associated privacy of information. The author concludes that by adding CMIA protections for these services is a critical and common sense step to ensure a sufficient baseline of privacy to protect consumers.
According to the Author
The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule provides consumers with important privacy rights and protections with respect to their health information, including important controls over how their health information is used and disclosed by health plans and health care providers. Ensuring strong privacy protections is critical to maintaining individuals' trust in their health care providers and willingness to obtain needed health care services, and these protections are especially important where very sensitive information is concerned, such as mental health and reproductive health information.
Federal guidance. According to the U.S. Department of Health and Human Services Agency (HHSA), the HIPAA Privacy Rule protects the privacy and security of medical and other health information when it is transmitted or maintained bymcovered entities (health plans, most health care providers, health care clearinghouses) and business associates (people and companies that provide certain services for covered entities). This information is referred to as protected health information (PHI), and it includes individually identifying information, such as name, address, age, social security number, and location, as well as information about health history, any diagnoses or conditions, current health status, and more. According to the HHSA, the HIPAA Rules generally do not protect the privacy or security of health information when it is accessed through or stored on personal cell phones or tablets. The HIPAA Rules apply only when PHI is created, received, maintained, or transmitted by covered entities and business associates. For example, the HIPAA Rules do not protect the privacy of Internet search history, information voluntarily shared online, or geographic location information. In most cases, unless the app is provided by a covered entity or its business associate, the HIPAA Rules also do not protect the privacy of data downloaded or entered into mobile apps for personal use. The information that devices or apps collect about you may be viewed or collected by other entities or used by the device or app vendors to send specific ads. It may also be sold to a data broker, someone who obtains and shares consumer information without their knowledge, often selling it for marketing or other purposes. For specific apps, individual apps may have collected information about location and activities, including the name and location of doctors' offices and the time and date of any visits. For example, apps for social media, directions and maps, and ride sharing often collect location or activity information.
In response to the Supreme Court ruling in Dobbs vs. Jackson Women's Health Organization (the Supreme Court Case that held that the Constitution does not confer a right to abortion; Roe and Casey are overruled; and the authority to regulate abortion is returned to the people and their elected representatives), HHSA took action to protect access to sexual and reproductive health care, including abortion, pregnancy complications, and other related care. The HHSA Office for Civil Rights (OCR) issued guidance to help protect patients seeking reproductive health care, as well as their providers. In general, the guidance does two things:
- addresses how federal law and regulations protect individuals' PHI relating to abortion and other sexual and reproductive health care, making it clear that providers are not required to disclose private medical information to third parties; and,
- ii) addresses the extent to which private medical information is protected on personal cell phones and tablets, and provides tips for protecting individuals' privacy when using period trackers and other health information apps.
According to the HHSA, many patients are concerned that period trackers and other health information apps on smartphones may threaten their right to privacy by disclosing geolocation data which may be misused by those seeking to deny care. The OCR guidance addresses the circumstances under which the HIPAA Privacy Rule permits disclosure of PHI without an individual's authorization. It explains that disclosures for purposes not related to health care, such as disclosures to law enforcement officials, are permitted only in narrow circumstances tailored to protect the individual's privacy and support their access to health care, including abortion care. Specifically, the guidance:
- reminds HIPAA covered entities and business associates that they can use and disclose PHI, without an individual's signed authorization, only as expressly permitted or required by the HIPAA Privacy Rule; and,
- ii) explains the HIPAA Privacy Rule's restrictions on disclosures of PHI when required by law, for law enforcement purposes, and to avert a serious threat to health or safety.
A 2022 Los Angeles Times article, entitled, "How data from period-tracking and pregnancy apps could be used to prosecute pregnant people" described a recent report indicating that many popular reproductive health apps are lacking when it comes to protecting users' data privacy and many of the apps had vague privacy policies that did not spell out what data could be shared with government agencies or law enforcement. According to the article, health data input into most period-tracking apps is not subject to HIPAA. A vague privacy policy can mean users will not know what data are being shared, with whom and under what circumstances, forcing users to blindly trust a company to protect their information. This bill would ensure that reproductive or sexual health digital service information is protected under the CMIA.
Arguments in Support
The California Pan-Ethnic Health Network (CPEHN) states that this bill will ensure that users can be assured that sensitive digital information about their reproductive and sexual health will have the same protections and privacy as their medical information. Thus, this bill will create continuous data protection across health platforms for abortion and gender-affirming care. CPEHN believes that this bill will increase not only privacy and protection but also equitable and safe access for communities of color who request sexual reproductive health services digitally. Oakland Privacy writes that this bill will provide the express inclusion of privacy protections of reproductive and sexual health digital products and services under the CMIA. This privacy expansion is a vital and necessary component to protect consumer's personal health data, protect privacy, and reduce the potential of facing discrimination harms.
Arguments in Opposition
There is no known opposition.
FISCAL COMMENTS
According to the Assembly Appropriations Committee, no direct costs.
VOTES
ASM HEALTH: 13-0-2
YES: Wood, Waldron, Aguiar-Curry, Arambula, Boerner Horvath, Lackey, Maienschein, McCarty, Joe Patterson, Rodriguez, Santiago, Villapudua, Weber
ABS, ABST OR NV: Wendy Carrillo, Flora
ASM PRIVACY AND CONSUMER PROTECTION: 10-0-1
YES: Gabriel, Joe Patterson, Bauer-Kahan, Bennett, Essayli, Irwin, Lowenthal, Papan, Wicks, Wilson
ABS, ABST OR NV: Vince Fong
ASM APPROPRIATIONS: 15-0-1
YES: Holden, Megan Dahle, Bryan, Calderon, Wendy Carrillo, Dixon, Mike Fong, Addis, Lowenthal, Papan, Pellerin, Robert Rivas, Sanchez, Weber, Wilson
ABS, ABST OR NV: Mathis
UPDATED
VERSION: April 17, 2023
CONSULTANT: Kristene Mapile / HEALTH / (916) 319-2097 FN: 0000357
Date of Hearing: May 10, 2023
ASSEMBLY COMMITTEE ON APPROPRIATIONS
Chris Holden, Chair
ABPCA Bill Id:AB 254
Author:(Bauer-Kahan) – As Amended Ver:April 17, 2023
Policy Committee: | Health | Vote: | 13 - 0 |
Privacy and Consumer Protection | 10 - 0 | ||
|
|
Urgency: No State Mandated Local Program: Yes Reimbursable: No
SUMMARY:
This bill deems a business that offers a reproductive or sexual health digital service for the purpose of allowing an individual to manage the individual’s information, or for the individual’s diagnosis, treatment, or management of a medical condition, to be a provider of health care for the purposes of the Confidentiality of Medical Information Act (CMIA). This bill revises the CMIA to include reproductive or sexual health application information in the definition of medical information.
FISCAL EFFECT:
No direct state costs.
COMMENTS:
- Purpose. According to the author:
The lax data security of apps that track menstrual cycles or pregnancy means this data could be easily acquired and used as evidence to criminalize pregnancy loss, abortion, or gender-affirming care.
For menstrual cycle tracking, the first questions users must answer before even entering the interface is often “Are you pregnant?” Other questions include those about birth control methods, symptoms, family history, lifestyle, and other highly sensitive data. However, these apps offer little in the way of protection for that data, with obscure privacy policies and little meaningful regulation. A Consumer Reports study found that none of the leading menstrual tracking apps offer transparency about who they share data with. The majority of these apps also use 3rd party trackers.
The data that users provide to apps can be sold, and can be used in criminalizing these individuals for the care they receive or predatory advertising based on a diagnosis...[T]he privacy provided by the services is insufficient to the sensitivity of the data they collect. The most popular app, Flo, was cited by the [Federal Trade Commission] for collecting and selling sensitive health data… Clearly, enforcement under existing laws is not going far enough.
- CMIA. The CMIA prohibits a health care provider, health plan, contractor, corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, or as otherwise required or authorized by law. A violation of the CMIA that results in economic loss or personal injury to a patient is a crime.
For purposes of the CMIA, medical information is defined as any individually identifiable information, in electronic or physical form, in possession of or derived from a health care provider, health plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental health app information, mental or physical condition, or treatment. In addition, any business organized for the purpose of maintaining medical information for an individual or a provider of health care at the request of the individual or the provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis and treatment of the individual, is deemed to be a health care provider subject to the requirements of the CMIA. - Related Legislation.
- AB 352 (Bauer-Kahan) requires specified businesses that electronically store or maintain medical information on sensitive services on behalf of a health care provider, health plan, pharmaceutical company, contractor, or employer to develop capabilities, policies, and procedures to enable certain security features, including limiting user access privileges and segregating medical information related to sensitive services. AB 352 is pending in this committee.
- AB 793 (Bonta) prohibits a government entity from seeking or obtaining information from a reverse-location demand or a reverse-keyword demand, and prohibits any person or government entity from complying with a reverse-location demand or a reverse-keyword demand. That bill is pending in this committee.
- AB 1194 (Wendy Carillo) provides that a business is not obligated to comply with a government agency request for emergency access to a consumer’s personal information if the information is related to accessing, procuring or searching for services regarding contraception, pregnancy care and perinatal care, including, but not limited to, abortion services. AB 1194 is pending in this committee.
- Prior Legislation. AB 1242 (Bauer-Kahan), Chapter 627, Statutes of 2022, protects reproductive digital information handled by companies incorporated or headquartered in California and prevents the arrest of individuals or the disclosure by law enforcement of information in an investigation related to any abortion that is legal in California.
Analysis Prepared by: Allegra Kim / APPR. / (916) 319-2081
Date of Hearing: April 25, 2023
ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION
Jesse Gabriel, Chair
ABPCA Bill Id:AB 254 (
Author:Bauer-Kahan) – As Amended Ver:April 17, 2023
SUBJECT: Confidentiality of Medical Information Act: reproductive or sexual health application information
SYNOPSIS
This is one of three bills being heard in the Committee today that directly seeks to further California’s goal of protecting the intimate, reproductive privacy rights of California residents and those from other jurisdictions who may have come to California to seek abortion care.
This bill seeks to ensure that commercial websites and applications that collect consumer reproductive health data are subject to California’s medical privacy laws. According to the author, there remain serious loopholes in existing protections for digital health information—loopholes that are being increasingly exploited by a murky industry of digital care. In addition, lax data security of apps that track menstrual cycles or pregnancy means this data could be easily acquired and used as evidence to criminalize pregnancy loss, abortion, or gender-affirming care. Specifically, this bill revises the Confidentiality of Medical Information Act (CMIA) to include reproductive or sexual health application information in the definition of “medical information.” In addition it deems any business that offers a reproductive or sexual health digital service to a consumer to be a provider of health care under the CMIA.
With the fall of Roe v. Wade, a number of states moved quickly to restrict abortions and punish those who are suspected of helping people obtain them. Oklahoma, for example, passed the nation’s strictest abortion ban in order to immediately end the ability of people in the state to obtain the procedure. The state quickly followed the ban by making the providing of an abortion a felony punishable by a fine of up to $100,000 and up to 10 years in prison.
Given the actions of so many states to not only ban abortion and gender affirming care within their borders, but to criminalize and punish people who assist someone in obtaining that care, whether within the state or in traveling to another state, taking additional steps to secure personal information related to a person’s reproductive health that could conceivably be used as evidence that someone has received that care is of the utmost importance.
As the examples above demonstrate, it is becoming increasingly dangerous for people to seek abortion services in many parts of the country. This bill is a sensible measure that closes a loophole in the CMIA and furthers California’s over-fifty-year commitment to being a reproductive freedom state. This bill is supported by the American Civil Liberties Union, the California Federation of Teachers, and Oakland Privacy, among others.
This bill passed the Assembly Health Committee on a bipartisan 13-0-2 vote.
SUMMARY: Revises the Confidentiality of Medical Information Act (CMIA) to include reproductive health application information, as defined, in the statutory definition of “medical information.” Deems a business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the individual’s diagnosis, treatment, or management of a medical condition, to be a provider of health care, as specified. Specifically, this bill:
- Defines the following terms:
- “Medical information” includes reproductive or sexual health application information.
- “Reproductive or sexual health application information” means information related to a consumer’s reproductive health, menstrual cycle, fertility, pregnancy, miscarriage, pregnancy termination, plans to conceive, or type of sexual activity collected by a reproductive or sexual health digital service, including, but not limited to, information from which one can infer someone’s pregnancy status, menstrual cycle, fertility, hormone levels, birth control use, sexual activity or gender identity.
- “Reproductive or sexual health digital service” means a mobile-based application or internet website that collects reproductive or sexual health application information from a consumer, markets itself as facilitating reproductive or sexual health services to a consumer, and uses the information to facilitate reproductive or sexual health services to a consumer.
- Deems any business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the individual’s diagnosis, treatment, or management of a medical condition, to be a provider of health care under the CMIA. Clarifies that this bill is not to be construed as making a business specified in this bill to be a provider of health care for purposes of any law other than this bill.
EXISTING LAW:
- Provides, pursuant to the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const., art. I, § 1.)
- Provides that the state shall not deny or interfere with an individual’s reproductive freedom in their most intimate decisions, which includes their fundamental right to choose to have an abortion and their fundamental right to choose or refuse contraceptives. (Cal. Const., art. I, § 1.1.)
- Establishes under federal law, the Health Information Portability and Accountability Act of 1996 (HIPAA), which sets standards for the privacy of individually identifiable health information and security standards for the protection of electronic protected health information, including, through regulations, that a HIPAA-covered entity may not condition the provision of treatment, payment, enrollment in a health plan, or eligibility for benefits on the provision of an authorization, except under specified circumstances. Provides that if HIPAA’s provisions conflict with state law, the provision that is most protective of patient privacy prevails. (42 U.S.C. § 1320d, et seq.; 45 Code Fed. Regs. Part 164.)
- Prohibits, under the state CMIA, a health care provider, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, as specified, or as otherwise required or authorized by law. States that a violation of these provisions that results in economic loss or personal injury to a patient is a crime. (Civ. Code § 56, et. seq.)
- Defines, for purposes of the CMIA, medical information to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental health app information, mental or physical condition, or treatment. (Civ. Code § 56.05(i).)
- Prohibits health care providers, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code § 56.10(a).)
- Deems any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis and treatment of the individual, to be a health care provider subject to the requirements of the CMIA. (Civ. Code § 56.06(a).)
- Deems any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be deemed to be a health care provider subject to the requirements of the CMIA. (Civ. Code § 56.06(b).)
- Deems any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be deemed to be a health care provider. (Civ. Code § 56.06(d).)
- Establishes the California Consumer Privacy Act (CCPA). (Civ. Code §§ 1798.100-1798.199.100.)
- Provides that the CCPA applies to any for-profit entity that collects consumers’ personal information, does business in California, and meets one or more of the following criteria:
- It had gross annual revenue of over $25 million in the previous calendar year.
- It buys, receives, or sells the personal information of 100,000 or more California residents, households, or devices annually.
- It derives 50% or more of its annual revenue from selling California residents’ personal information. (Civ. Code § 1798.140(d).)
- Defines “consumer” as a natural person who is a California resident. (Civ. Code § 1798.140(i).)
- Provides a consumer, subject to exemptions and qualifications, various rights, including the following:
- The right to know the business or commercial purpose for collecting, selling, or sharing personal information and the categories of persons to whom the business discloses personal information. (Civ. Code § 1798.110.)
- The right to request that a business disclose the specific pieces of information the business has collected about the consumer, and the categories of third parties to whom the personal information was disclosed. (Civ. Code § 1798.110.)
- The right to request deletion of personal information that a business has collected from the consumer. (Civ. Code § 1798.105.)
- The right to opt-out of the sale of the consumer’s personal information if the consumer is over 16 years of age. (Sale of the personal information of a consumer below the age of 16 is barred unless the minor opts-in to its sale.) (Civ. Code § 1798.120.)
- The right to equal service and price, despite the consumer’s exercise of any of these rights, unless the difference in price is reasonably related to the value of the customer’s data. (Civ. Code § 1798.125.)
- Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes such information as:
- Name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, social security number, driver’s license number, passport number, or other identifier.
- Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
- Biometric information.
- Internet activity information, including browsing history and search history.
- Geolocation data.
- Professional or employment-related information. (Civ. Code § 1798.140(v).)
- Establishes the Reproductive Privacy Act, which provides that the Legislature finds and declares that every individual possesses a fundamental right of privacy with respect to personal reproductive decisions, which entails the right to make and effectuate decisions about all matters relating to pregnancy, including prenatal care, childbirth, postpartum care, contraception, sterilization, abortion care, miscarriage management, and infertility care. Accordingly, it is the public policy of the State of California that:
- Every individual has the fundamental right to choose or refuse birth control;
- Every individual has the fundamental right to choose to bear a child or to choose to obtain an abortion, with specified limited exceptions; and,
- The state shall not deny or interfere with a person’s fundamental right to choose to bear a child or to choose to obtain an abortion, except as specifically permitted. (Health & Saf. Code § 123462.)
- Provides that the state may not deny or interfere with a person’s right to choose or obtain an abortion prior to viability of the fetus or when the abortion is necessary to protect the life or health of the person. (Health. & Saf. Code § 123466 (a).)
- States that a person shall not be compelled in a state, county, city, or other local criminal, administrative, legislative, or other proceeding to identify or provide information that would identify or that is related to an individual who has sought or obtained an abortion if the information is being requested based on either another state’s laws that interfere with a person’s rights under subdivision (a) or a foreign penal civil action. (Health & Saf. Code § 123466(b).
FISCAL EFFECT: As currently in print this bill is keyed fiscal.
COMMENTS:
1) The need for this bill. This bill is modeled after the author’s successful AB 2089 (Bauer-Kahan, Ch. 690, Stats. 2022), which amended the CMIA to include mental health application information. Similarly, this bill seeks to ensure that commercial websites and applications that collect consumer reproductive health data are subject to California’s medical privacy laws. According to the author, there remain serious loopholes in existing protections for digital health information–loopholes that are being increasingly exploited by a murky industry of digital care. In addition, lax data security of apps that track menstrual cycles or pregnancy means this data could be easily acquired and used as evidence to criminalize pregnancy loss, abortion, or gender-affirming care.
For menstrual cycle tracking, the first question users must often answer before even entering the interface is “Are you pregnant?” Other questions include those about birth control methods, symptoms, family history, lifestyle, and other highly sensitive data. According to the author, however, these apps offer little in the way of protection for that data, with obscure privacy policies and little meaningful regulation. A Consumer Reports study found that none of the leading menstrual tracking apps offer transparency about who they share data with. The majority of these apps also use 3rd party trackers. The data that users provide to apps can be sold, and can be used in criminalizing these individuals for the care they receive or predatory advertising based on a diagnosis. In addition to the legal risks, being tracked across the internet with ads about this sensitive information can be incredibly stigmatizing and dissuades people from getting care.
(Catherine Roberts, These Period Tracker Apps Say They Put Privacy First. Here’s What We Found. Consumer Reports (May 25, 2022, updated Aug 30, 2022), available at https://www.consumerreports.org/health-privacy/period-tracker-apps-privacy-a2278134145/.)
As cybersecurity experts point out, prior to Roe v. Wade being overturned in 2022, having all kinds of information shared about you without your knowledge may have felt mildly creepy and annoying, but not necessarily threatening. However, in light of increased abortion restrictions in many states, the sharing of information with third parties on the internet can be dangerous. With abortion now illegal in a number of states, prosecutors may now be able to use data from period tracking apps (or other online data) to show that someone was getting a period at one point, then was not getting it, and later resumed getting a period as evidence suggesting that they may have had an abortion. (Ibid.)
2) Author’s statement. According to the author:
Reproductive and sexual health information is clearly health information, and is particularly sensitive given the criminalization of almost any form of ending a pregnancy. Our current data protections do not speak to the sensitivity of this data. Apps and websites that explicitly market themselves as providing menstrual and pregnancy tracking are creating an expectation of healthcare and the associated privacy of information. Adding CMIA protections for these services is a critical and common sense step to ensure a sufficient baseline of privacy to protect consumers.
3) Post-Dobbs access to reproductive healthcare is being restricted across the nation. Roe v. Wade (1973) 410 U.S. 113 was the landmark U.S. Supreme Court decision that held the implied constitutional right to privacy extended to a person’s decision whether to terminate a pregnancy, while allowing that some state regulation of abortion access could be permissible. Roe has been one of the most debated of all U.S. Supreme Court decisions, and its application and validity have been challenged numerous times, but its fundamental holding had continuously been upheld by the Court until June 2022. On June 24, 2022 the Court published its official opinion in Dobbs and voted 6-3 to overturn the holding in Roe. (Dobbs v. Jackson Women’s Health (2022) 597 U.S. __ (142 S.Ct. 2228), available at https://www.supremecourt.gov/opinions/21pdf/19-1392_6j37.pdf.)
The case involved a Mississippi law enacted in 2018 that banned most abortions after the first 15 weeks of pregnancy, which is before what is generally accepted as the period of viability. (See Miss. Code Ann. § 41-41-191.) The majority opinion in Dobbs upholds the Mississippi law, finding that, contrary to almost 50 years of precedent, there is no fundamental constitutional right to have an abortion. The opinion further provides that states should be allowed to decide how to regulate abortion and that a strong presumption of validity should be afforded to those state laws.
The Roe decision was the foundation for allowing people the ability to control their reproductive lives because it established a federal constitutional right for anyone who could become pregnant in the United States to decide when and if to have children and prevented the criminalization of having an abortion or providing an abortion. Prior to Roe, legal abortion did exist in some states but the choices available to those seeking to terminate an unwanted pregnancy were limited and disproportionately affected those who were younger, lower income, and members of communities of color. In the wake of the Dobbs decision it is very probable that abortion will be banned or severely restricted in 24 states, with 12 states already having near total abortion bans in effect. (Elizabeth Nash and Isabel Guarnieri, Six Months Post-Roe, 24 US States Have Banned Abortion or Are Likely to Do So: A Roundup. Guttmacher Institute (Jan. 10, 2023), available at https://www.guttmacher.org/2023/01/six-months-post-roe-24-us-states-have-banned-abortion-or-are-likely-do-so-roundup.)
With the announcement of the Dobbs decision, a number of states moved quickly to restrict abortions and punish those who are suspected of helping people obtain them. Oklahoma, for example, passed the nation’s strictest abortion ban in order to immediately end the ability of people in the state to obtain the procedure. The ban allows an abortion in the case of rape or incest, if the pregnant person reports the crime to law enforcement. In addition, the ban authorizes doctors to remove a "dead unborn child caused by spontaneous abortion," or miscarriage, or to remove an ectopic pregnancy, a potentially life-threatening emergency that occurs when a fertilized egg implants outside the uterus, often in a fallopian tube and early in pregnancy. A second Oklahoma bill went into effect in August 2022, made performing an abortion a felony, with a punishment of up to 10 years in prison and a fine of up to $100,000. [Associated Press, Oklahoma governor signs the nation’s strictest abortion ban, NPR, (May 26, 2022), available at https://www.npr.org/2022/05/26/1101428347/oklahoma-governor-signs-the-nations-strictest-abortion-ban.)
Along with an existing ban on abortions after six weeks, earlier this month, the Governor of Idaho signed a bill into law that makes it illegal for an adult to help a minor get an abortion without parental consent. This law is the first of its kind in the nation, creating the new crime of “abortion trafficking” by barring adults from obtaining abortion pills for a minor or “recruiting, harboring or transporting the pregnant minor” without parental consent. Anyone convicted faces two to five years in prison and can be sued by the minor’s parent. However, parents who rape their child will not be able to sue, but the abortion trafficking criminal penalties will still apply. According to a recent Associate Press article in The Guardian, in order to sidestep violating a constitutional right to travel between states, the law makes illegal only the in-state portion of the trip to an out-of-state abortion provider. (Associated Press, Idaho governor signs law banning adults from helping minors get abortions. The Guardian (April 6, 2023), available at https://www.theguardian.com/us-news/2023/apr/06/idaho-abortion-trafficking-law-governor.)
4) California is a reproductive freedom state. The California Supreme Court held in 1969 that the state constitution’s implied right to privacy extends to an individual’s decision about whether or not to have an abortion. (People v. Belous (1969) 71 Cal. 2d 954.) This was the first time an individual’s right to abortion was upheld in a court and came before the Roe decision. In 1972, the California voters passed a constitutional amendment that explicitly provided for the right to privacy in the state constitution. (Prop. 11, Nov. 7, 1972 gen. elec.) California statutory law provides, under the Reproductive Privacy Act, that the Legislature finds and declares every individual possesses a fundamental right of privacy with respect to personal reproductive decisions, which entails the right to make and effectuate decisions about all matters relating to pregnancy; therefore, it is the public policy of the State of California that every individual has the fundamental right to choose or refuse birth control, and every individual has the fundamental right to choose to bear a child or to choose to obtain an abortion. (Health & Saf. Code § 123462.) In 2019, Governor Newsom issued a proclamation reaffirming California’s commitment to making reproductive freedom a fundamental right in response to the numerous attacks on reproductive rights across the nation. (California Proclamation on Reproductive Freedom (May 31, 2019), available at https://www.gov.ca.gov/wp-content/uploads/2019/05/Proclamation-on-Reproductive-Freedom.pdf.)
In September 2021, over 40 organizations came together to form the California Future Abortion Council (CA FAB) to identify barriers to accessing abortion services and to recommend policy proposals to support equitable and affordable access for not only Californians, but all who seek care in this state. CA FAB issued its first report in December 2021, which included 45 policy recommendations to protect, strengthen, and expand abortion access in California. (California Future of Abortion Council, Recommendations to Protect, Strengthen, and Expand Abortion Care in California (Dec. 2021), available at https://www.cafabcouncil.org/_files/ugd/ddc900_0beac0c75cb54445a230168863566b55.pdf.] In response to the Dobbs decision and CA FAB’s report, California enacted a comprehensive package of legislation that protects the rights of patients seeking abortion in the state and those supporting them. Additionally, the voters overwhelmingly approved Proposition 1 (Nov. 8, 2022 gen. elec.), and enacted an express constitutional right in the state constitution that prohibits the state from interfering with an individual’s reproductive freedom in their most intimate decisions.
Last year, several bills were enacted to further protect reproductive rights in California, among them:
1. AB 1242 (Bauer-Kahan, Ch. 627, Stats. 2022) protects reproductive digital information handled by companies incorporated or headquartered in California and prevents the arrest of individuals or the disclosure by law enforcement of information in an investigation related to any abortion that is legal in California.
2. AB 1666 (Bauer-Kahan, Ch. 42, Stats. 2022) declares that a law of another state that authorizes a person to bring a civil action against a person or entity that receives or seeks, performs or induces, or aids or abets the performance of an abortion, or who attempts or intends to engage in those actions, is contrary to the public policy of this state.
3. AB 2091 (Bonta, Ch. 628, Stats. 2022) prohibits a provider of health care, health care service plan, or contractor from releasing medical information related to an individual seeking or obtaining an abortion in response to a subpoena or request if that subpoena or request is based on either another state's laws that interfere with a person's rights set forth in the Reproductive Privacy Act and prohibits the issuance of a subpoena, from the Superior Court or an attorney licensed in California, based on a civil action authorized by the law of a state other than this state in which the sole purpose is to punish an offense against the public justice of that state.
4. AB 2223 (Wicks, Ch. 629, Stats. 2022) prohibits a person from being criminally or civilly liable for miscarriage, stillbirth, abortion, or perinatal death due to causes that occurred in utero.
5) Analysis of the bill. As discussed above, California has taken and continues to take steps to continue to be a reproductive freedom state, as it has been since 1969, and in the post-Roe era, to become an abortion sanctuary state. Given the actions of so many states to not only ban abortion within their borders, but to criminalize and punish people who assist someone in obtaining an abortion, whether within the state or in traveling to another state, taking additional steps to secure personal information related to a person’s reproductive health that could conceivably be used as evidence that someone has obtained an abortion or gender affirming care is of the utmost importance. In keeping with the Legislature and the Governor’s commitment to insuring that the intimate, reproductive privacy rights of people traveling to or temporarily living in California is protected, whether someone is receiving reproductive health services through a traditional healthcare provider or system or through an online application, any information collected should be protected under the CMIA. This is a sensible measure that closes a loophole in the law and adds critical protections for people seeking abortions, gender-affirming care, or information on their reproductive health that may inadvertently provide evidence that they have received care that has been deemed illegal in another state.
6) Related legislation. In the current session, AB 352 (Bauer-Kahan) would require specified businesses that electronically store or maintain medical information on the provision of sensitive services on behalf of a provider of health care, health care service plan, pharmaceutical company, contractor, or employer to develop capabilities, policies, and procedures, on or before July 1, 2024, to enable certain security features, including limiting user access privileges and segregating medical information related to sensitive services, as specified. That bill is currently pending before this Committee.
In the current session, AB 793 (Bonta) would prohibit a government entity from seeking or obtaining information from a reverse-location demand or a reverse-keyword demand, and prohibits any person or government entity from complying with a reverse-location demand or a reverse-keyword demand. That bill is currently pending before the Assembly Appropriations Committee.
In the current session, AB 1194 (Wendy Carillo) would, if the consumer’s personal information contains information related to accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care, including, but not limited to, abortion services, require a business to comply with the obligations imposed by the CPRA. It would also specify that a consumer accessing, procuring, or searching for those services does not constitute a natural person being at risk or danger of death or serious physical injury. That bill is currently pending before this Committee.
AB 2089 (Bauer-Kahan, Ch. 690, Stats. 2022) amended the CMIA to include mental health application information. The bill also defined “mental health application information” as information related to a consumer’s inferred or diagnosed mental health or substance use disorder, as defined in existing law, collected by a mental health digital service; and “mental health digital service” as a mobile-based application or internet website that collects mental health application information from a consumer, markets itself as facilitating mental health services to a consumer, and uses the information to facilitate mental health services to a consumer. The bill deemed any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individual's information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be a health care provider, as specified. Finally, the bill required any business that offers a mental health digital service to provide to the health care provider information regarding how to find data breaches reported, as specified, on the Attorney General’s website.
AB 1184 (Chiu, Ch. 190, Stats. 2021) revised and recasted provisions to require a health care service plan (health plan) or health insurer, effective July 1, 2022, to accommodate requests for confidential communication of medical information regardless of whether there is a situation involving sensitive services or a situation in which disclosure would endanger the individual. The bill also prohibited a health plan or health insurer from requiring a “protected individual,” as defined, to obtain the policyholder’s, primary subscriber’s, or other enrollee or insured’s authorization to receive health care services or to submit a claim, if the protected individual has the right to consent to care. The bill required the health plan or health insurer to direct all communications regarding a protected individual's receipt of sensitive health care services directly to the protected individual, and prohibited the disclosure of that information to the policyholder, primary subscriber, or any plan enrollees or insureds without the authorization of the protected individual. Finally, the bill expanded the definition of “sensitive services” to identify all health care services related to mental health, reproductive health, sexually transmitted infections, substance use disorder, transgender health, including gender affirming care, and intimate partner violence, and includes services, as specified.
AB 2167 (Chau, 2018) would have amended CMIA to include within the definition of medical information, any information in possession of, or derived from, a digital health feedback system. AB 2167 would have required manufacturers or operators that sell devices or applications that may be used as part of these digital health feedback systems to equip them with reasonable security features, as specified. AB 2167 died on the Senate Floor.
SB 1121 (Dodd, Ch. 735, Stats. 2018) modified the CCPA, by requiring a business that collects personal information about a consumer to disclose the consumer’s right to delete personal information in a form that is reasonably accessible to consumers.
AB 375 (Chau, Ch. 55, Stats. 2018) enacted the CCPA, which grants a consumer a right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of third parties with which the information is shared.
ARGUMENTS IN SUPPORT:
The ACLU writes in support of the bill:
Current privacy laws do not adequately protect the sensitive information collected by reproductive or sexual health apps. In California, patient privacy is protected by the Confidentiality of Medical Information Act (CMIA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA), neither of which contemplate personal health information generated by technology outside the traditional care setting. Combined, these two laws only protect health information that is generated by healthcare providers, insurers and health plans, pharmaceutical companies, healthcare clearinghouses and businesses organized for the purpose of maintaining medical information. The information created by new health technologies, such as reproductive or sexual health apps, do not fall cleanly into this rubric. While the California Consumer Privacy Act (CCPA) applies to information collected by reproductive or sexual health apps, the law does not protect consumer data to the same extent as the medical privacy laws, creating uneven privacy protections for health information collected by new health technology versus data created by providers. For example, whereas CCPA permits data sharing but requires access, deletion, and limits on the sale of data to third parties upon request, CMIA and HIPAA prohibit most cases of sharing at all.
The California Federation of Teachers (CFT) writes in support of the bill:
While it is empowering to have modern tools to get a better understanding of reproductive and sexual health, using these tools should not come at the expense of giving up privacy rights and being required to surrender sensitive health information. Furthermore, reproductive and sexual health digital products and service providers collect and share a lot of sensitive information and consumers don’t know and often can’t control who is accessing this data.
This bill creates continuous data protection across health platforms for abortion and gender affirming care. With AB 254, users can be assured that sensitive digital information about their reproductive and sexual health will have the same protections and privacy as their medical information.
ARGUMENTS IN OPPOSITION:
REGISTERED SUPPORT / OPPOSITION:
Support
AccessNow
Accountable Tech
ACLU California Action
ADL
American College of Obstetricians and Gynecologists District Ix
CA Legislative Women's Caucus
California Federation of Teachers
California Pan - Ethnic Health Network
Center For Digital Democracy
CFA
Consumer Reports
Demand Progress
Doctors In Politics
EKO
Electronic Frontier Foundation
epic.org
Fairplay
Fight For The Future
Free Press
Friends of the Earth
glaad
Health Care Voices
KAIROS
Mozilla
Oakland Privacy
She Persisted
Sister Song
Super-majority
ultraviolet Action
Vote Pro Choice
Opposition
1 individual
Analysis Prepared by: Julie Salley / P. & C.P. / (916) 319-2200
Date of Hearing: March 14, 2023
ASSEMBLY COMMITTEE ON HEALTH
Jim Wood, Chair
ABPCA Bill Id:AB 254
Author:(Bauer-Kahan) – As Introduced Ver:January 19, 2023
SUBJECT: Confidentiality of Medical Information Act: reproductive or sexual health application information.
SUMMARY: Revises the Confidentiality of Medical Information Act (CMIA) to include reproductive or sexual health application information into the definition of medical information. Deems a business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the individual’s diagnosis, treatment, or management of a medical condition, to be a provider of health care, as specified. Specifically, this bill:
- Defines the following:
- Medical information to include reproductive or sexual health application information;
- Reproductive or sexual health application information to mean information related to a consumer’s reproductive or sexual health collected by a reproductive or sexual health digital service; and,
- Reproductive or sexual health digital service to mean a mobile-based application or internet website that collects reproductive or sexual health application information from a consumer, markets itself as facilitating reproductive or sexual health services to a consumer, and uses the information to facilitate reproductive or sexual health services to a consumer.
- Deems any business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the individual’s diagnosis, treatment, or management of a medical condition, to be a provider of health care. Clarifies that this bill is not to be construed as making a business specified in this bill to be a provider of health care for purposes of any law other than this bill.
EXISTING LAW:
- Establishes under federal law, the Health Information Portability and Accountability Act of 1996 (HIPAA), which sets standards for privacy of individually identifiable health information and security standards for the protection of electronic protected health information, including, through regulations, that a HIPAA covered entity may not condition the provision of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of an authorization, except under specified circumstances. Provides that if HIPAA’s provisions conflict with state law, the provision that is most protective of patient privacy prevails. [45 Code of Federal Regulations §164.500, et. seq.]
- Prohibits, under the state CMIA, a health care provider, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, as specified, or as otherwise required or authorized by law. States that a violation of these provisions that results in economic loss or personal injury to a patient is a crime. [Civil Code (CIV) §56, et. seq.]
- Defines, for purposes of the CMIA, medical information to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental health app information, mental or physical condition, or treatment. [CIV §56.05(i)]
- Prohibits health care providers, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. [CIV §56.10(a)]
- Deems any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis and treatment of the individual, to be a health care provider subject to the requirements of the CMIA. [CIV §56.06(a)]
- Deems any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be deemed to be a health care provider subject to the requirements of the CMIA. [CIV §56.06(b)]
- Deems any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be deemed to be a health care provider. [CIV §5606 (d)]
- Establishes the California Consumer Privacy Act of 2018 (CCPA) which grants a consumer a right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of third parties with which the information is shared; and, the California Privacy Rights Act which amends and extends CCPA and creates the California Privacy Protection Agency to implement and enforce CCPA. [CIV §1798.100, et seq.]
FISCAL EFFECT: Unknown. This bill has not yet been analyzed by a fiscal committee.
COMMENTS:
- PURPOSE OF THIS BILL. According to the author, reproductive and sexual health information is clearly health information, and is particularly sensitive given the criminalization of almost any form of ending a pregnancy. The author points out that current data protections do not speak to the sensitivity of this data. Apps and websites that explicitly market themselves as providing menstrual and pregnancy tracking are creating an expectation of healthcare and the associated privacy of information. The author concludes that by adding CMIA protections for these services is a critical and common sense step to ensure a sufficient baseline of privacy to protect consumers.
- BACKGROUND. The HIPAA Privacy Rule provides consumers with important privacy rights and protections with respect to their health information, including important controls over how their health information is used and disclosed by health plans and health care providers. Ensuring strong privacy protections is critical to maintaining individuals’ trust in their health care providers and willingness to obtain needed health care services, and these protections are especially important where very sensitive information is concerned, such as mental health and reproductive health information.
- Federal guidance. According to the U.S. Department of Health and Human Services Agency (HHSA), the HIPAA Privacy Rule protects the privacy and security of medical and other health information when it is transmitted or maintained by covered entities (health plans, most health care providers, health care clearinghouses) and business associates (people and companies that provide certain services for covered entities). This information is referred to as protected health information (PHI), and it includes individually identifying information, such as name, address, age, social security number, and location, as well as information about health history, any diagnoses or conditions, current health status, and more. According to the HHSA, the HIPAA Rules generally do not protect the privacy or security of health information when it is accessed through or stored on personal cell phones or tablets. The HIPAA Rules apply only when PHI is created, received, maintained, or transmitted by covered entities and business associates. For example, the HIPAA Rules do not protect the privacy of Internet search history, information voluntarily shared online, or geographic location information. In most cases, unless the app is provided by a covered entity or its business associate, the HIPAA Rules also do not protect the privacy of data downloaded or entered into mobile apps for personal use. The information that devices or apps collect about you may be viewed or collected by other entities or used by the device or app vendors to send specific ads. It may also be sold to a data broker, someone who obtains and shares consumer information without their knowledge, often selling it for marketing or other purposes. For specific apps, individual apps may have collected information about location and activities, including the name and location of doctor’s office and the time and date of any visits. For example, apps for social media, directions and maps, and ride sharing often collect location or activity information.
In response to the Supreme Court ruling in Dobbs vs. Jackson Women’s Health Organization (the Supreme Court Case that held that the Constitution does not confer a right to abortion; Roe and Casey are overruled; and the authority to regulate abortion is returned to the people and their elected representatives), HHSA took action to protect access to sexual and reproductive health care, including abortion, pregnancy complications, and other related care. The HHS Office for Civil Rights (OCR) issued guidance to help protect patients seeking reproductive health care, as well as their providers. In general, the guidance does two things: i) addresses how federal law and regulations protect individuals’ PHI relating to abortion and other sexual and reproductive health care, making it clear that providers are not required to disclose private medical information to third parties; and, ii) addresses the extent to which private medical information is protected on personal cell phones and tablets, and provides tips for protecting individuals’ privacy when using period trackers and other health information apps.
According to the HHSA, many patients are concerned that period trackers and other health information apps on smartphones may threaten their right to privacy by disclosing geolocation data which may be misused by those seeking to deny care. The OCR guidance addresses the circumstances under which the HIPAA Privacy Rule permits disclosure of PHI without an individual’s authorization. It explains that disclosures for purposes not related to health care, such as disclosures to law enforcement officials, are permitted only in narrow circumstances tailored to protect the individual’s privacy and support their access to health care, including abortion care. Specifically, the guidance: i) reminds HIPAA covered entities and business associates that they can use and disclose PHI, without an individual’s signed authorization, only as expressly permitted or required by the HIPAA Privacy Rule; and, ii) explains the HIPAA Privacy Rule’s restrictions on disclosures of PHI when required by law, for law enforcement purposes, and to avert a serious threat to health or safety.
A 2022 Los Angeles Times article, entitled, “How data from period-tracking and pregnancy apps could be used to prosecute pregnant people” described a recent report indicating that many popular reproductive health apps are lacking when it comes to protecting users’ data privacy and many of the apps had vague privacy policies that did not spell out what data could be shared with government agencies or law enforcement. According to the article, health data input into most period-tracking apps is not subject to HIPAA. A vague privacy policy can mean users will not know what data are being shared, with whom and under what circumstances, forcing users to blindly trust a company to protect their information. This bill would ensure that reproductive or sexual health digital service information is protected under the CMIA.
- SUPPORT. Oakland Privacy writes that this bill will provide the express inclusion of privacy protections of reproductive and sexual health digital products and services under the CMIA. This privacy expansion is a vital and necessary component to protect consumer’s personal health data, protect privacy, and reduce the potential of facing discrimination harms.
- CONCERNS. ATA Action is concerned the broad definitions of “reproductive or sexual health application information” and “reproductive or sexual health digital service” don't provide enough clarity as to the types of information that are being targeted by these privacy provisions and is unsure as to which applications or websites fall under these definitions. The definition of “reproductive and sexual health digital service” uses vague and seemingly all-encompassing language that offers providers and entities in the reproductive or sexual health care space with little direction as to whether or not the requirements of this bill apply to them, raising many questions in the process and ATA Action suggests clarifying the language to limit the scope of the proposed legislation to information that has been inputted by the consumer into the reproductive or sexual health service.
- RELATED LEGISLATION.
- AB 1432 (Carrillo) subjects a policy or certificate of group health insurance that is marketed, issued, or delivered to a California resident to any Insurance Code provisions requiring coverage of abortion, abortion-related services, and gender-affirming care, regardless of the situs of the contract or master group policyholder. AB 1432 is pending in Assembly Health Committee.
- AB 352 (Bauer-Kahan) states Legislative intent to enact legislation to protect reproductive and sexual health information. AB 352 is currently pending referral in Assembly Rules Committee.
- PREVIOUS LEGISLATION.
- AB 2089 (Bauer-Kahan), Chapter 690, Statutes of 2022, amends the CMIA to include mental health application information. Defines mental health application information as information related to a consumer's inferred or diagnosed mental health or substance use disorder, as defined in existing law, collected by a mental health digital service; and, mental health digital service as a mobile-based application or internet website that collects mental health application information from a consumer, markets itself as facilitating mental health services to a consumer, and uses the information to facilitate mental health services to a consumer. Deems any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individual's information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be a health care provider, as specified. Requires any business that offers a mental health digital service to provide to the health care provider information regarding how to find data breaches reported, as specified, on the Attorney General website.
- AB 2091 (Bonta), Chapter 628, Statutes of 2022, prohibits compelling a person to identify or provide information that would identify or that is related to an individual who has sought or obtained an abortion in a state, county, city, or other local criminal, administrative, legislative, or other proceeding if the information is being requested based on another state’s laws that interfere with a person’s right to choose or obtain an abortion or a foreign penal civil action, as defined. Prohibits a provider of health care, a health care service plan, a contractor, or an employer from releasing medical information that would identify an individual or related to an individual seeking or obtaining an abortion in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another state’s laws that interfere with a person’s rights to choose or obtain an abortion or a foreign penal civil action. AB 2091 also prohibits issuance of a subpoena if the submitted foreign subpoena relates to a foreign penal civil action and the submitted foreign subpoena would require disclosure of information related to sensitive services, as defined.
- AB 1184 (Chiu), Chapter 190, Statutes of 2021, revises and recasts provisions to require a health care service plan (health plan) or health insurer, effective July 1, 2022, to accommodate requests for confidential communication of medical information regardless of whether there is a situation involving sensitive services or a situation in which disclosure would endanger the individual. Prohibits a health plan or health insurer from requiring a protected individual, as defined, to obtain the policyholder, primary subscriber, or other enrollee or insured's authorization to receive health care services or to submit a claim, if the protected individual has the right to consent to care. Requires the health plan or health insurer to direct all communications regarding a protected individual's receipt of sensitive health care services directly to the protected individual, and prohibits the disclosure of that information to the policyholder, primary subscriber, or any plan enrollees or insureds without the authorization of the protected individual, as provided. Expands the definition of sensitive services to identify all health care services related to mental health, reproductive health, sexually transmitted infections, substance use disorder, transgender health, including gender affirming care, and intimate partner violence, and includes services, as specified.
- AB 2167 (Chau) of 2018 would have amended CMIA to include within the definition of medical information, any information in possession of, or derived from, a digital health feedback system. AB 2167 would have required manufacturers or operators that sell devices or applications that may be used as part of these digital health feedback systems to equip them with reasonable security features, as specified. AB 2167 died on the Senate Floor.
- SB 1121 (Dodd), Chapter 735, Statutes of 2018, modifies the CCPA, by requiring a business that collects personal information about a consumer to disclose the consumer’s right to delete personal information in a form that is reasonably accessible to consumers, as specified.
- AB 375 (Chau), Chapter 55, Statutes of 2018, enacts CCPA, and grants a consumer a right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of third parties with which the information is shared.
- DOUBLE REFERRAL. This bill has been double-referred; upon passage of this committee, it will be referred to the Assembly Privacy and Consumer Protection Committee.
REGISTERED SUPPORT / OPPOSITION:
Support
Oakland Privacy
Opposition
None on file.
Analysis Prepared by: Kristene Mapile / HEALTH / (916) 319-2097
Discussed in Hearing
45SEC
Assembly Floor
2MIN
Senate Floor
6MIN
Senate Standing Committee on Health
8MIN
Senate Standing Committee on Judiciary
1MIN
Assembly Floor
7MIN
Assembly Standing Committee on Privacy and Consumer Protection
11MIN
