Privacy: mental health digital services: mental health application information.

Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) , establishes certain requirements relating to the provision of health insurance, including provisions relating to the confidentiality of health records. Existing state law, the Confidentiality of Medical Information Act (CMIA) , prohibits a provider of health care, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor. Existing law requires a person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, to disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California who meets certain criteria, including that the resident's unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Existing law requires a person or business that is required to issue a security breach notification pursuant to that provision to more than 500 California residents as a result of a single breach of the security system to electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. This bill would revise the definition of medical information to include mental health application information. The bill would define mental health application information to mean information related to a consumer's inferred or diagnosed mental health or substance use disorder, as specified, collected by a mental health digital service, as defined. The bill would provide that any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individual's information, or for the diagnosis, treatment, or management of a medical condition of the individual, is deemed to be a provider of health care subject to the requirements of CMIA. The bill would require a business that offers a mental health digital service, when partnering with a provider of health care, to provide to the provider information regarding how to find data breaches reported pursuant to the provisions described above on the internet website of the Attorney General. Because the bill would expand the definition of a crime, it would impose a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.