CCPA Amended to Address HIPAA Exemption, Deidentified Data Rules
The National Law Review
Last month California Governor Gavin Newsom signed AB 713 into law, which more closely aligns CCPA to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and other laws governing scientific research. Although these changes may help ease compliance challenges for the health care and life sciences industries, the changes only exempt from the CCPA certain types of data rather than exempt health companies entirely.
What has changed?
AB 713 expands the CCPA exceptions for HIPAA business associates and HIPAA de-identified data that can be particularly helpful in the area of research. Importantly, AB 713 solves the disconnect between the CCPA and HIPAA’s arguably less burdensome de-identification standards. Absent this “fix,” data could have been sufficiently deidentified to be exempt from HIPAA, yet not sufficiently deidentified to be exempt from CCPA, creating a much more complicated legal regime for health companies.
AB 713 also expands...