Processes de-identified data, in California

CCPA, Cal. Civ. Code sections 1798.146(a)(4) and 1798.148 · Read the law's page

• Do not reidentify, or attempt to reidentify, information that is deidentified under 45 CFR 164.514 and derived from patient information originally collected, created, transmitted, or maintained by an entity regulated by HIPAA, the Confidentiality of Medical Information Act or the Common Rule, except for treatment, payment or health care operations conducted by a covered entity or by a business associate at its written direction, public health activities, research under the Common Rule, a contract engaging a person to test or validate deidentification, or where otherwise required by law (Civ. Code section 1798.148(a)).
• If you engage a person to attempt reidentification to test, analyze or validate deidentification, put in the contract a ban on any other use or disclosure of the reidentified information and a requirement to return or destroy it when the work is complete (Civ. Code section 1798.148(a)(4)).
• Treat information you reidentify under an exception as subject to applicable federal and state data privacy and security laws, including HIPAA, the Confidentiality of Medical Information Act and the CCPA (Civ. Code section 1798.148(b)).
• When you sell or license deidentified patient information and a party resides or does business in California, put in the contract a statement that the information includes deidentified patient information, a statement that the purchaser or licensee may not reidentify or attempt to reidentify it, and a requirement that, unless otherwise required by law, the purchaser or licensee not disclose it further to a third party unless that party is contractually bound by the same or stricter restrictions and conditions (Civ. Code section 1798.148(c)).

CCPA, Cal. Civ. Code section 1798.140(m) · Read the law's page

• To treat information as deidentified under the CCPA, take reasonable measures to ensure that it cannot be associated with a consumer or household (Civ. Code section 1798.140(m)(1)).
• Publicly commit to maintain and use the information in deidentified form and not to attempt to reidentify it, except that you may attempt to reidentify it solely to determine whether your deidentification processes meet the definition (Civ. Code section 1798.140(m)(2)).
• Contractually obligate every recipient of the information to comply with all provisions of the definition (Civ. Code section 1798.140(m)(3)).