California’s new CCPA (California Consumer Privacy Act) may become more like HIPAA. In particular, a proposed amendment would apply HIPAA’s standards of expert determination to CCPA.
According to this article,
The California State Senate’s Health Committee recently approved California AB 713, which would amend the California Consumer Privacy Act (CCPA) to except from CCPA requirements additional categories of health information, including data de-identified in accordance with HIPAA and certain medical research data.
Some businesses have been looking to HIPAA by analogy for how to comply with CCPA. HIPAA has been on the books much longer, and what it means to comply with HIPAA is more clearly stated, in regulation itself and in guidance documents. AB 713 would make this appeal to HIPAA more than an analogy.
In particular, CCPA would now have a notion of expert determination. AB 713 explicitly refers to
The deidentification methodology described in Section 164.514(b)(1) of Title 45 of the Code of Federal Regulations, commonly known as the HIPAA expert determination method.
Emphasis added. Taken from 1798.130 (a)(5)(D)(i).
Update: California’s governor signed AB 713 into law on September 25, 2020.
Parsing AB 713
The amendment is hard to read because it doesn’t contain many complete sentences. The portion quoted above doesn’t have a verb. We have to go to up to (a) in the hierarchy before we can find a clear subject and verb:
… a business shall …
It’s not clear to me what the amendment is saying. Rather than trying to parse this myself, I’ll quote what the article linked above says.
AB 713 would except from CCPA requirements de-identified health information when … The information is de-identified in accordance with a HIPAA de-identification method [and two other conditions].
Expert determination
I am not a lawyer; I advise lawyers on statistical matters. I offer statistical advice, not legal advice.
If your lawyer determines that you need HIPAA-style expert determination to comply with CCPA, I can help. I have provided expert determination for many companies and would welcome the opportunity to provide this service for your company as well.
If you’d like discuss expert determination, either for HIPAA or for CCPA, let’s talk.