Information privacy: digital health feedback systems.

Existing law, the Confidentiality of Medical Information Act, generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as otherwise specified. Existing law defines "medical information" for purposes of these provisions to mean certain individually identifiable health information in possession of or derived from a provider of health care, among others. Existing law also defines the term "provider of health care" for purposes of these provisions and provides that any business that offers software or hardware to consumers for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, is deemed to be a provider of health care subject to the requirements of the act. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor. This bill would define "medical information" for purposes of the act to include any information in possession or derived from a digital health feedback system, which the bill would define. The bill would also require a manufacturer or operator that sells or offers to sell a device or software application that may be used with a digital health feedback system to a consumer in California to equip the device or software application, and the system, with reasonable security features appropriate to the nature of the device, software application, or system and the information it may collect, contain, or transmit, that protect the device, software application, or system and any information contained therein from unauthorized access, destruction, use, modification, or disclosure. Because this bill would expand the definition of a crime, it would impose a state-mandated local program. The bill would make other related conforming changes. This bill would incorporate additional changes to Section 56.06 of the Civil Code proposed by AB 2402 to be operative only if this bill and AB 2402 are enacted and this bill is enacted last. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.