Even the strictest privacy advocates recognize privacy cannot be absolute; the recent surge of laws and proposed legislation expanding consumer privacy rights is not without risk. The California Legislature is currently trying to strike this balance in one important area: health care and research. As currently drafted, the California Consumer Privacy Act leaves many questions unresolved regarding how the law applies to data collected and used in the health care and life sciences industries, particularly in the research context. Clinical research sponsors and other industry participants, many of whom are already subject to other privacy and data security laws, have raised concerns about how the CCPA may impede care delivery and research efforts and, as a result, limit medical advancement.

Proposed CCPA amendment Assembly Bill 713 would harmonize the CCPA with the deidentification standards set forth in the Health Insurance Portability and Accountability Act and its implementing regulations and provide other important clarifications for health care providers and their vendors, research sponsors and other organizations engaged in health care delivery or research. With this proposal, California legislators have acknowledged the need to clarify the scope of the CCPA for health care and research data, declaring the bill an "urgency statute," meaning it would take effect immediately upon signature by the California governor.    

At the time of this writing, AB 713 passed unanimously out of the California Senate Health Committee and was referred to the Senate Standing Committee on Judiciary. As noted above, the most recent version of the bill makes it clear that California legislators believe there is an urgent need to resolve questions about the CCPA’s existing health care and life sciences exemptions, with a recent amendment adding to the text of the statute that it is “necessary for the immediate preservation of the public peace, health, or safety ... (because the CCPA) will negatively impact certain health-related information and research. The provisions of this act would mitigate that harm by preserving access to information needed to conduct important health-related research that will benefit Californians.”

AB 713 covers five major principles, as follows.

HIPAA deidentification

Although the CCPA already excludes deidentified data from its definition of personal information, some companies have asked that the CCPA deidentification standard be aligned with existing standards, like the HIPAA deidentification standard. The proposed amendment would do just that, at least for certain deidentified health data.

AB 713 specifically excludes personal information from the CCPA if that information:

• Has been deidentified pursuant to either of the two methodologies permitted under HIPAA: (1) expert determination; or (2) the "safe harbor" (i.e., removal of the specified 18 identifiers).
• Is derived from protected health information or individually identifiable health information (each as defined by HIPAA), “medical information” governed by the California Confidentiality of Medical Information Act, or identifiable private information subject to the Federal Policy for the Protection of Human Subjects (also known as the Common Rule). 
• Finally, if a business and its business associates do not re-identify or attempt to re-identify the deidentified personal information.

This change would give health care and life sciences companies more confidence that their objectively deidentified data — which is generally exempt from privacy laws like HIPAA — is also exempt from the CCPA.

HIPAA business associates

AB 713 exempts HIPAA business associates (e.g., service providers processing PHI for or on behalf of HIPAA-covered entities) to the extent they handle PHI in accordance with the requirements of HIPAA, even if the underlying patient information is not technically subject to HIPAA (e.g., if the medical provider to which the vendor provides services does not accept insurance or otherwise conduct standard transactions covered by HIPAA). If passed, this amendment will confirm an exemption for business associates that protects all patient information in accordance with HIPAA standards.  

Medical research

While the CCPA already contains a limited research exemption, industry stakeholders have long requested clarification and expansion. The existing clinical research exemption in the CCPA applies only to “information collected as part of a clinical trial subject to the Federal Policy for the Protection of Human Subjects, also known as the Common Rule, pursuant to good clinical practice guidelines issued by the International Council for Harmonisation or pursuant to human subject protection requirements of the United States Food and Drug Administration.” The current exclusion does not address many of the industry standard frameworks used for clinical trials and medical research.

Due to the potentially limited scope of this exemption, some life sciences companies requested during the initial rule-making comment period that the California attorney general specifically expand the scope of research that would be exempt from the CCPA, but no further insight was offered either in the initial draft regulations or the recently issued revised draft regulations. At the same time, some organizations engaged in research questioned whether Institutional Review Board approved research — even if not considered a clinical trial otherwise subject to the current listed standards — would be exempt. Many industry stakeholders expressed concern that the narrowly defined exemption would impede research activities.

Recognizing these concerns and the potential for the CCPA to hinder important research, AB 713 significantly expands the existing research exemption. The bill exempts from the CCPA personal information collected for or used in biomedical research that is subject to IRB standards and the ethics and privacy laws of the Common Rule, good clinical practice guidelines issued by the International Council for Harmonisation, or human subject protection requirements of the U.S. Food and Drug Administration, as well as personal information collected for or used in research, subject to all applicable ethics and privacy laws, if the information is either individually identifiable health information as defined under HIPAA or medical information governed by the CMIA. AB 713 also revises the existing clinical trial exemption to make it clear that any of the three listed standards could apply. Together, the proposed new language and revisions would provide much-needed clarity and relief to health care and life sciences companies that have had ongoing questions about the scope of CCPA’s applicability to clinical and biomedical research.

Product and medical device tracking

AB 713 also provides a limited exemption for personal information collected by a business for product registration and tracking consistent with FDA regulations, activities related to quality, safety or effectiveness regulated by the FDA, or for other federally regulated public health activities and purposes. This is consistent with HIPAA, which allows for limited disclosure of PHI, without an authorization for these types of public health activities. While the proposed exemption should provide some relief to drug and device companies, it applies only to some of the provisions of the CCPA; the disclosure and breach enforcement provisions would still apply.

Privacy disclosures.

Finally, while AB 713 exempts deidentified health and research data from the CCPA if the data meets the standards described above, it does add a disclosure requirement for such information. Under the proposed amendment, a business that discloses or sells such deidentified information must disclose in its online privacy policy:

• That the business discloses or sells deidentified health information.
• Which deidentification method was used.

This effectively expands the CCPA, as “deidentified” personal information falls outside the CCPA’s scope and therefore currently requires no disclosure. In fact, data protection laws, including HIPAA, generally exclude notice requirements for deidentified or anonymized data altogether. It is also unclear what benefit this disclosure will provide to consumers, as the fundamental theory behind using deidentified data is to eliminate any opportunity to link it to an individual consumer.

The addition of urgency language to AB 713 and a proposed immediate effective date highlight legislative concerns about the CCPA’s negative impact on health-related research and treatment. It is promising that California legislators have recognized the need to strike the appropriate balance between consumer data protections and medical innovations that could lead to more effective medications, less invasive procedures, easier disease detection and life-saving treatments. While the CCPA is new; now is the time for California legislators to address its growing pains.

Photo by Joseph Barrientos on Unsplash