Today's Law As Amended

PDF |Add To My Favorites | print page

AB-2402 Cannabis: personal information.(2017-2018)



SECTION 1.

 Section 26161.5 is added to the Business and Professions Code, to read:

26161.5.
 (a) A licensee shall not disclose a consumer’s personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensee’s disclosure of the personal information. This section does not prohibit the disclosure of nonpublic personal information to the State of California or a city, county, or city and county to perform official duties pursuant to this division or a local ordinance.
(b) A licensee shall not discriminate against a consumer, or deny a consumer a product or service, because the consumer has not provided consent, pursuant to subdivision (a), to authorize the licensee to disclose the consumer’s nonpublic personal information to a third party not directly related to the transaction.
(c) For purposes of this section, “personal information” has the same meaning as defined in subdivision (d) of Section 1798.81.5 of the Civil Code.
(d) For the purposes of this section, “third party” does not include a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain a consumer’s personal information for any other purpose or share a consumer’s personal information with any party other than the contracting licensee.
(e) This section provides greater protection to personal information than that provided by Section 1798.81.5 of the Civil Code, which does not apply to licensees under this division pursuant to paragraph (5) of subdivision (e) of Section 1798.81.5 of the Civil Code.

SEC. 2.

 Section 26162.5 of the Business and Professions Code is amended to read:

26162.5.
 (a) Identification cards issued pursuant to Section 11362.71 of the Health and Safety Code are hereby deemed “medical information” within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as (1) necessary for the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance, or (2) to a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain medical information for any other purpose or share information with any party other than the contracting licensee.
(b) Information contained in a physician’s recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 and received by a licensee, including, but not limited to, the name, address, or social security number of the patient, the patient’s medical condition, or the name of the patient’s primary caregiver is hereby deemed “medical information” within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as (1) necessary for the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance, or (2) to a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain medical information for any other purpose or share information with any party other than the contracting licensee.

SEC. 3.

 Section 56.06 of the Civil Code is amended to read:

56.06.
 (a) Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(b) Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c) Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physician’s recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(d) Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.
(e) Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.

SEC. 3.5.

 Section 56.06 of the Civil Code is amended to read:

56.06.
 (a) Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) (k)  of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(b) Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) (k)  of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c) Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physician’s recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(d) Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.
(e) Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.
SEC. 4.
 Section 3.5 of this bill incorporates amendments to Section 56.06 of the Civil Code proposed by both this bill and Assembly Bill 2167. That section of this bill shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2019, (2) each bill amends Section 56.06 of the Civil Code, and (3) this bill is enacted after Assembly Bill 2167, in which case Section 3 of this bill shall not become operative.
SEC. 5.
 No reimbursement is required by this act pursuant to Section 6 of Article XIII B of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIII B of the California Constitution.