Information privacy: digital health feedback systems.

Existing law, the Confidentiality of Medical Information Act, generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as otherwise specified. Existing law defines "medical information" for purposes of these provisions to mean certain individually identifiable health information in possession of or derived from a provider of health care, among others. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor. This bill would define "personal health record information" for purposes of the act to mean individually identifiable information, in electronic or physical form, about an individual's mental or physical condition that is collected by a product or device, commercial internet website, online service, or mobile application that is used by an individual and that is specifically designed to collect and transmit, directly or indirectly, the individual's personal health record information through a direct measurement of an individual's mental or physical condition or through user input regarding an individual's mental or physical condition. The bill would provide that a business that offers a personal health record system to a consumer, shall not knowingly use, disclose, or permit the use or disclosure of personal health record information without a signed authorization, as specified. The bill would also prohibit a recipient of personal health record information pursuant to an authorization from further disclosing the health record information unless in accordance with a new authorization, as specified. The bill would make a violation of these provisions subject to specified administrative fines and civil penalties.