Law / United States / 
California
California Consumer Privacy Act, reidentification of deidentified patient information
CCPA, Cal. Civ. Code sections 1798.146(a)(4) and 1798.148
In force since .
A de-identification rule binding public and private bodies.
- Obligation class
- Prohibition
- Audit expectation
- none
What it requires
- Do not reidentify, or attempt to reidentify, information that is deidentified under 45 CFR 164.514 and derived from patient information originally collected, created, transmitted, or maintained by an entity regulated by Health Insurance Portability and Accountability Act (HIPAA), the Confidentiality of Medical Information Act or the Common Rule, except for treatment, payment or health care operations conducted by a covered entity or by a business associate at its written direction, public health activities, research under the Common Rule, a contract engaging a person to test or validate deidentification, or where otherwise required by law (Civ. Code section 1798.148(a)).
- If you engage a person to attempt reidentification to test, analyze or validate deidentification, put in the contract a ban on any other use or disclosure of the reidentified information and a requirement to return or destroy it when the work is complete (Civ. Code section 1798.148(a)(4)).
- Treat information you reidentify under an exception as subject to applicable federal and state data privacy and security laws, including HIPAA, the Confidentiality of Medical Information Act and the CCPA (Civ. Code section 1798.148(b)).
- When you sell or license deidentified patient information and a party resides or does business in California, put in the contract a statement that the information includes deidentified patient information, a statement that the purchaser or licensee may not reidentify or attempt to reidentify it, and a requirement that, unless otherwise required by law, the purchaser or licensee not disclose it further to a third party unless that party is contractually bound by the same or stricter restrictions and conditions (Civ. Code section 1798.148(c)).
These lines are LexLint's reading of the law's text.
If you get it wrong
Private right of actionNo
Penalty structure
Civ. Code section 1798.155(a) sets an administrative fine, enforced by the California Privacy Protection Agency, and section 1798.199.90(a) a civil penalty, recovered by the Attorney General, of not more than $2,500 for each violation or $7,500 for each intentional violation of the title, as enacted. The ban in section 1798.148 is part of the title. The Agency adjusts the figures for inflation under section 1798.199.95(d) in January of each odd-numbered year; the adjustment that took effect on raised them to $2,663 and $7,988, and the higher figure is the per-violation amount here. Section 1798.150(c) confines the private cause of action to the data-breach violations defined in section 1798.150(a).
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 7,988
Who enforces it
Enforcement body
California Privacy Protection Agency (administrative enforcement) and the California Attorney General (civil actions).
What it makes you log
Logging duty
Sections 1798.146(a)(4) and 1798.148 bar reidentification of deidentified patient information and set the terms of contracts that sell or license it. They state no log or record duty.
- Kind
- None
- As of
What this law does
Section 1798.148(a) bars a business or other person from reidentifying, or attempting to reidentify, information that has met the requirements of section 1798.146(a)(4), except for one or more of five listed purposes.
Information meets section 1798.146(a)(4) when it is deidentified in accordance with the requirements for deidentification set forth in section 164.514 of Part 164 of Title 45 of the Code of Federal Regulations and is derived from patient information that was originally collected, created, transmitted, or maintained by an entity regulated by the Health Insurance Portability and Accountability Act, the Confidentiality Of Medical Information Act, or the Federal Policy for the Protection of Human Subjects, also known as the Common Rule.
Section 1798.148(a)(1) and (2) permit reidentification for treatment, payment, or health care operations conducted by a covered entity or by a business associate acting on behalf of, and at the written direction of, the covered entity, and for public health activities or purposes as described in section 164.512 of Title 45 of the Code of Federal Regulations.
Section 1798.148(a)(3) permits reidentification for research, as defined in section 164.501 of Title 45 of the Code of Federal Regulations, that is conducted in accordance with Part 46 of Title 45 of the Code of Federal Regulations, the Federal Policy for the Protection of Human Subjects, also known as the Common Rule.
Section 1798.148(a)(4) permits reidentification pursuant to a contract where the lawful holder of the deidentified information expressly engages a person or entity to attempt to reidentify it in order to conduct testing, analysis, or validation of deidentification, or related statistical techniques, if the contract bans any other use or disclosure of the reidentified information and requires the return or destruction of the information that was reidentified upon completion of the contract.
Section 1798.148(a)(5) permits reidentification if otherwise required by law. Section 1798.148(b) subjects information reidentified under that section to applicable federal and state data privacy and security laws, including the Health Insurance Portability and Accountability Act, the Confidentiality of Medical Information Act, and the title that contains the section.
Under section 1798.146(a)(4)(B), information that met the requirements of section 1798.146(a)(4)(A) but is subsequently reidentified is no longer eligible for the exemption in that paragraph.
Under section 1798.148(c), beginning , any contract for the sale or license of deidentified information that has met the requirements of section 1798.146(a)(4), where one of the parties is a person residing or doing business in the state, must include the following, or substantially similar, provisions: a statement that the deidentified information being sold or licensed includes deidentified patient information, a statement that reidentification, and attempted reidentification, of the deidentified information by the purchaser or licensee is prohibited pursuant to the section, and a requirement that, unless otherwise required by law, the purchaser or licensee may not further disclose the deidentified information to any third party unless the third party is contractually bound by the same or stricter restrictions and conditions.
Section 1798.148(d) defines reidentify as the process of reversal of deidentification techniques, including the addition of specific pieces of information or data elements that can, individually or in combination, be used to uniquely identify an individual or usage of any statistical method, contrivance, computer software, or other means that have the effect of associating deidentified information with a specific identifiable individual.
Section 1798.155(a) makes any business, service provider, contractor, or other person that violates the title liable for an administrative fine of not more than $2,500 for each violation or $7,500 for each intentional violation, as adjusted pursuant to subdivision (d) of section 1798.199.95, in an administrative enforcement action brought by the California Privacy Protection Agency.
Section 1798.199.90(a) makes any business, service provider, contractor, or other person that violates the title subject to an injunction and liable for a civil penalty of not more than $2,500 for each violation or $7,500 for each intentional violation, assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General.
Section 1798.150(c) provides that the cause of action established by that section applies only to violations as defined in its subdivision (a) and is not to be based on violations of any other section of the title.
When LexLint raises it
When your app profile says your app handles health records, processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .