Note: After having various conversation with a few students learning about HIPAA, State Laws, and GDPR, we thought it would be useful to post a handout provided to the class.
California Consumer Privacy Act (CCPA) of 2018
Assembly Bill (AB) No. 375: Chapter 55
Beginning January 1, 2020, the bill would grant a consumer the right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer.
Consumer Privacy Law for companies that deal with personal data and those operating in the digital space. Companies that collect web browsing data and generate revenue from targeted advertising over internet platforms or service providers will be affected:
- AT&T
- Verizon
CCPA applies to for profit entities that both collect and process the personal information of California residents and do business in the State of California. However, a physical presence in California is not a requirement, and it appears that making sales in the state would be enough. Additionally, the business must meet at least one of the following criteria for the CCPA to apply (see blue box). Nonprofit businesses, as well as companies that don’t meet any of the mentioned thresholds, are not required to comply with the CCPA.
Historical Background: SB 1386, Peace. Personal information: Privacy
On September 25, 2002, the California Senate Bill No. 1386 Chapter 915 was approved by Governor September 25, 2002 and filed with the Secretary of State September 26, 2002.
“Existing law regulates the maintenance and dissemination of personal information by state agencies, as defined, and requires each agency to keep an accurate account of disclosures made pursuant to specified provisions. Existing law also requires a business, as defined, to take all reasonable steps to destroy a customer’s records that contain personal information when the business will no longer retain those records. Existing law provides civil remedies for violations of these provisions.
This bill, operative July 1, 2003, would require a state agency, or a person or business that conducts business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, any breach of the security of the data, as defined, to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The bill would permit the notifications required by its provisions to be delayed if a law enforcement agency determines that it would impede a criminal investigation. The bill would require an agency, person, or business that maintains computerized data that includes personal information owned by another to notify the owner or licensee of the information of any breach of security of the data, as specified. The bill would state the intent of the Legislature to preempt all local regulation of the subject matter of the bill. This bill would also make a statement of legislative findings and declarations regarding privacy and financial security.”
The new privacy law (CCPA) Assembly Bill No. 375, will allow California residents to delete their data or bring it with them to alternative service providers. Data brokers who generate profits by collecting consumer data & profit by selling it to a third party are affected too:
- Acxiom
- Epsilon
- Experian
- Oracle
The Privacy Act contains a broad definition of “personal information”, as defined below.
The state’s attorney general will be the enforcer of this law. However, consumers will maintain a private right of action should companies fail to maintain reasonable security practices, resulting in unauthorized access to their personal data.
California residents will have a multitude of new Rights:
- To know what personal information is being collected about them
- To know whether their personal information is sold or disclosed and to whom
- To say no to the sale of personal information
- To access their personal information
- To have equal service and price, even if they exercise their privacy rights
- To receive financial incentives from businesses for providing their personal information
- To prohibit a business from selling the personal information for under 16 years old consumers
For more information see AB 375 CCPA
“Personal information” is defined under the CCPA as “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” The addition of the term “household” adds a dimension to a privacy law that is largely uncharted territory. Specifically, information collected by a business does not have to be associated with a name or specific individual, but rather can identify a household.
The definition of “personal information” under the CCPA also lists a wide range of standard examples that includes Social Security numbers, drivers’ license numbers and purchase histories, but also “unique personal identifiers” such as device identifiers and other online tracking technologies.
Note: CCPA excludes information that is publicly available.
Europe’s General Data Protection Regulation (GDPR) Entered the U.S.
Brief Explanation: Global privacy regulation (EU Regulation 2016/679)
Healthcare businesses (providers, digital health/health IT companies, and their vendors) that “control” and/or ”process” health data in the U.S. that may include data from EU “data subjects” will be required to comply with the new EU General Data Protection Regulation (GDPR).
- Applicable as of May 25th, 2018 in all member states to harmonize data privacy laws across Europe
- GDPR is broader in scope than HIPAA, as its protections extend to all broadly defined “personal data,” not just Protected Health Information (PHI)
- Replaced the 1995 Data Protection Directive from the European Union, which only impacted U.S. companies that transferred the data of EU data subjects out of the EU
- GDPR affects all companies that do business with EU data subjects, whether or not they have a presence in the EU
- Any company that uses, collects, or retains any personal data from any European citizen, either knowingly or unknowingly, will have to comply with the GDPR – even if that citizen is physically located in the U.S
Concerns
Consumer confidence has been miserable and distressful post Equifax and Cambridge Analytica style compromising of our trust, leading to real consequences in personal identity theft , abuse and data privacy. Companies who were doing business in Europe under EU terms have had to deal with protecting privacy. California laws such as the two mentioned above SB 1386 and AB 375 are setting examples and we should not be surprised when other states follows to improve consumers security controls over the use of their data.
It is very simple, GDPR is similar to the U.S. State laws. HIPAA has many requirements corresponding to the GDPR requirements such as having policies, Data protection impact assessment, Technical vulnerability assessment, training, Data Protection Officer (DPO), etc.
Brief Explanation: HIPAA
Your RIGHTS Under HIPAA
Health Insurance Portability and Accountability Act of 1996
Public Law 104-191
Most of us believe that our medical and other health information is private and should be protected, and we want to know who has this information. The Privacy Rule, a Federal law, gives you rights over your health information and sets rules and limits on who can look at and receive your health information. The Privacy Rule applies to all forms of individuals’ Protected Health Information (PHI), whether electronic, written, or oral. The Security Rule is a Federal law that requires security for health information in electronic form.
To improve the efficiency and effectiveness of the health care system, HIPAA included Administrative Simplification provisions that required the U.S. Department of Health & Human Services (HHS) to adopt national standards for electronic health care transactions and code sets, unique health identifiers, and security. At the same time, Congress recognized that advances in electronic technology could erode the privacy of health information. Therefore, Congress incorporated into HIPAA provisions that mandated the adoption of Federal privacy protections for Individually Identifiable Health Information (IIHI).
Be Proactive not Reactive!
While numerous businesses are struggling to implement data strategies to assist them to meet regulatory requirements, it is not too late to start if you have not. With the potential risks and loss of customer trust that you jeopardise by not safeguarding your customers’ data, this is the perfect opportunity to act.
The CCPA has already been amended once and may go through additional updates before it takes effect, but businesses should start to prepare now. Privacy notices, other policies and procedures, and websites will need to be updated before the CCPA takes effect. At the very least, a business should start mapping the personal information that it collects and locations where personal information is stored so it can promptly meet any request under the CCPA.
Our team at RISC Management and Consulting are ready and able to assist your organization from all your Data privacy and information security requirements to State Laws and GDPR to protect your client’s Protected Health Information (PHI) and/or Personal information. We are committed to the success of our clients.
RISC Management and Consulting 
You must be logged in to post a comment.