Bill Text


Bill PDF |Add To My Favorites | print page

AB-2402 Cannabis: personal information.(2017-2018)

SHARE THIS: share this bill in Facebook share this bill in Twitter
Date Published: 09/20/2018 09:00 PM
AB2402:v92#DOCUMENT

Assembly Bill No. 2402
CHAPTER 583

An act to amend Section 26162.5 of, and to add Section 26161.5 to, the Business and Professions Code, and to amend Section 56.06 of the Civil Code, relating to cannabis.

[ Approved by Governor  September 20, 2018. Filed with Secretary of State  September 20, 2018. ]

LEGISLATIVE COUNSEL'S DIGEST


AB 2402, Low. Cannabis: personal information.
The Medicinal and Adult-Use Cannabis Regulation and Safety Act, among other things, provides for the licensure and regulation of commercial cannabis activity, including cultivation, manufacturing, distribution, and retail sale. Existing law requires licensees to maintain specified records of commercial cannabis transactions.
Existing law, the California Uniform Controlled Substances Act, makes various acts involving marijuana a crime except as authorized by law. Existing law, the Medical Marijuana Program (MMP), requires counties to administer an identification card program for qualified patients and provides immunity from arrest to qualified patients with a valid identification card or designated primary caregivers, within prescribed limits.
Existing law requires information identifying the names of patients, their medical conditions, or the names of their primary caregivers received and contained in records kept by the Bureau of Cannabis Control for the purposes of administering the act to be maintained in accordance with state law relating to patient access to his or her health records, the Confidentiality of Medical Information Act, and other state and federal laws relating to confidential patient information, and provides that this information is confidential and exempt from disclosure under the California Public Records Act, except as specified. Existing law deems information contained in a physician’s recommendation to use cannabis for medical purposes to be “medical information” within the meaning of the Confidentiality of Medical Information Act, and prohibits a licensee from disclosing this information, except as specified.
Existing law, the Confidentiality of Medical Information Act, prohibits providers of health care, health care service plans, contractors, employers, and 3rd-party administrators, among others, from disclosing medical information, as defined, without the patient’s written authorization, subject to certain exceptions, as specified. A violation of the act resulting in economic loss or personal injury to a patient is a misdemeanor and subjects the violating party to liability for specified damages and administrative fines and penalties.
This bill would prohibit a licensee from disclosing a consumer’s personal information, as defined, to a 3rd party, as specified, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensee’s disclosure of the personal information. The bill would prohibit a licensee from discriminating against a consumer or denying a consumer a product or service because he or she has not provided consent to authorize the licensee to disclose the consumer’s nonpublic personal information to a 3rd party not directly related to the transaction.
This bill would deem a business licensed under the Medicinal and Adult-Use Cannabis Regulation and Safety Act that is authorized to receive or receives identification cards issued pursuant to the MMP or information contained in a physician’s recommendation to be a provider of health care subject to the requirements of the Confidentiality of Medical Information Act. The bill would further deem identification cards issued to qualified patients to be “medical information” within the meaning of the Confidentiality of Medical Information Act, and would prohibit a licensee from disclosing that information, except as specified. The bill would provide exceptions to the prohibitions on disclosure of a consumer’s personal information, identification cards, and information contained in a physician’s recommendation for a contractor providing software services to a licensee, as specified. By expanding the scope of a crime, the bill would impose a state-mandated local program.
This bill would incorporate additional changes to Section 56.06 of the Civil Code proposed by AB 2167 to be operative only if this bill and AB 2167 are enacted and this bill is enacted last.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Vote: MAJORITY   Appropriation: NO   Fiscal Committee: YES   Local Program: YES  

The people of the State of California do enact as follows:


SECTION 1.

 Section 26161.5 is added to the Business and Professions Code, to read:

26161.5.
 (a) A licensee shall not disclose a consumer’s personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensee’s disclosure of the personal information. This section does not prohibit the disclosure of nonpublic personal information to the State of California or a city, county, or city and county to perform official duties pursuant to this division or a local ordinance.
(b) A licensee shall not discriminate against a consumer, or deny a consumer a product or service, because the consumer has not provided consent, pursuant to subdivision (a), to authorize the licensee to disclose the consumer’s nonpublic personal information to a third party not directly related to the transaction.
(c) For purposes of this section, “personal information” has the same meaning as defined in subdivision (d) of Section 1798.81.5 of the Civil Code.
(d) For the purposes of this section, “third party” does not include a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain a consumer’s personal information for any other purpose or share a consumer’s personal information with any party other than the contracting licensee.
(e) This section provides greater protection to personal information than that provided by Section 1798.81.5 of the Civil Code, which does not apply to licensees under this division pursuant to paragraph (5) of subdivision (e) of Section 1798.81.5 of the Civil Code.

SEC. 2.

 Section 26162.5 of the Business and Professions Code is amended to read:

26162.5.
 (a) Identification cards issued pursuant to Section 11362.71 of the Health and Safety Code are hereby deemed “medical information” within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as (1) necessary for the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance, or (2) to a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain medical information for any other purpose or share information with any party other than the contracting licensee.
(b) Information contained in a physician’s recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 and received by a licensee, including, but not limited to, the name, address, or social security number of the patient, the patient’s medical condition, or the name of the patient’s primary caregiver is hereby deemed “medical information” within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as (1) necessary for the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance, or (2) to a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain medical information for any other purpose or share information with any party other than the contracting licensee.

SEC. 3.

 Section 56.06 of the Civil Code is amended to read:

56.06.
 (a) Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(b) Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c) Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physician’s recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(d) Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.
(e) Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.

SEC. 3.5.

 Section 56.06 of the Civil Code is amended to read:

56.06.
 (a) Any business organized for the purpose of maintaining medical information, as defined in subdivision (k) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(b) Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (k) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c) Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physician’s recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(d) Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.
(e) Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.

SEC. 4.

 Section 3.5 of this bill incorporates amendments to Section 56.06 of the Civil Code proposed by both this bill and Assembly Bill 2167. That section of this bill shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2019, (2) each bill amends Section 56.06 of the Civil Code, and (3) this bill is enacted after Assembly Bill 2167, in which case Section 3 of this bill shall not become operative.

SEC. 5.

 No reimbursement is required by this act pursuant to Section 6 of Article XIII B of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIII B of the California Constitution.