Information privacy: digital health feedback systems.

Existing law, the Confidentiality of Medical Information Act, generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as otherwise specified. Existing law defines "medical information" for purposes of these provisions to mean certain individually identifiable health information in possession of or derived from a provider of health care, among others. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor. This bill would define "personal health record information" for purposes of the act to mean individually identifiable information, in electronic or physical form, about an individual's mental or physical condition that is collected by an FDA-approved commercial internet website, online service, or product that is used by an individual at the direction of a provider of health care with the primary purpose of collecting the individual's individually identifiable personal health record information through a direct measurement of an individual's mental or physical condition or through user input regarding an individual's mental or physical condition. The bill would provide that a business that offers personal health record software or hardware to a consumer, in order to make information available to an individual or provider of health care at the request of the individual or provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of the Confidentiality of Medical Information Act. Because the bill would expand the definition of a crime, it would impose a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.