On September 25, 2020, California Governor Gavin Newsom signed into law AB 713, amending the California Consumer Privacy Act (CCPA). Importantly, the bill clarifies the standard by which patient information is deemed de-identified and therefore exempt from CCPA. It also expands the law's research exception beyond research associated with clinical trials. Both changes are welcome clarifications for the healthcare, research and life sciences communities. The bill also contains new notice and contract obligations related to the sale or license of de-identified patient information, which are likely to have widespread implications.

The bill was passed as an urgency statute that takes effect immediately, with the California legislature recognizing that "[t]he provisions of [AB 713] would mitigate [the] harm [posed by the CCPA] as soon as possible by preserving access to information needed to conduct important health-related research that will benefit Californians." This article analyzes the bill as finalized.

|

Elimination of De-identification Ambiguity and Expansion of Research Exceptions

The finalized bill adopts the two exceptions to the definition of personal information that were contained in the proposed legislation. Under the first exception, information that has been de-identified pursuant to the standard found in the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule and that is derived from patient information originally collected, created, transmitted or maintained by an entity regulated by HIPAA, California's Confidentiality of Medical Information Act (CMIA), or the Federal Policy for the Protection of Human Subjects (also known as the Common Rule) is exempt from the requirements of the CCPA. De-identified information ceases to qualify for the exception if it is subsequently re-identified.