California: Unauthorized Access to Medical Info I took a Covid vaccine few weeks ago with Walgreens. Suddenly in the news, California states they have an electronic record of everyone's vaccine, just provide the info on a website, and you will get a QR digital copy. Where did California get authorization to receive my medical info from Walgreens? They have a right to keep anonymous survey numbers of How many people received the vaccine in state, however where did they get consent from citizens to track medical vaccine info, of who's taken and not. Seems like Nazi Germany, where California is keeping track of residents without consent. Of course nothing surprises me about California at this point. Is this legal, and can the State be indicted for breach of privacy? https://www.sacbee.com/news/politics-government/capitol-alert/article252208388.html https://www.northbaybusinessjournal.com/article/industrynews/california-unveils-system-to-provide-digital-covid-19-vaccine-records/ Website: https://myvaccinerecord.cdph.ca.gov/ Seems to be contradictory to information below: HIPAA as the following: &quot;The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge. &quot; CDC Website: https://www.cdc.gov/coronavirus/2019-ncov/vaccines/distributing/about-vaccine-data.html How does CDC report vaccine distribution and administration data? &quot;CDC uses the IZ Data Lake to receive, store, manage, and analyze COVID-19 vaccine distribution and administration data from all sources. Data in the IZ Data Lake are deidentified, meaning they do not identify specific people who have been vaccinated. CDC data scientists make sure the data in the IZ Data Lake are correct (validated) and that the system does not double-count any doses or vaccination records (deduplication).
Where did California get authorization to receive my medical info from Walgreens? From HIPAA. Permitted Uses and Disclosures. A covered entity is permitted, but not required, to use and disclose protected health information, without an individual’s authorization, for the following purposes or situations: (1) To the Individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and (6) Limited Data Set for the purposes of research, public health or health care operations.18 Covered entities may rely on professional ethics and best judgments in deciding which of these permissive uses and disclosures to make. ... (5) Public Interest and Benefit Activities. The Privacy Rule permits use and disclosure of protected health information, without an individual’s authorization or permission, for 12 national priority purposes.28 These disclosures are permitted, although not required, by the Rule in recognition of the important uses made of health information outside of the health care context. Specific conditions or limitations apply to each public interest purpose, striking the balance between the individual privacy interest and the public interest need for this information. ... Public Health Activities. Covered entities may disclose protected health information to: (1) public health authorities authorized by law to collect or receive such information for preventing or controlling disease, injury, or disability and to public health or other government authorities authorized to receive reports of child abuse and neglect; (2) entities subject to FDA regulation regarding FDA regulated products or activities for purposes such as adverse event reporting, tracking of products, product recalls, and post-marketing surveillance; (3) individuals who may have contracted or been exposed to a communicable disease when notification is authorized by law; and (4) employers, regarding employees, when requested by employers, for information concerning a work-related illness or injury or workplace related medical surveillance, because such information is needed by the employer to comply with the Occupational Safety and Health Administration (OHSA), the Mine Safety and Health Administration (MHSA), or similar state law. See: HIPAA Privacy Rule In plain English... A covered entity (Walgreens) is allowed to use and disclose your PHI without your authorization to public health authorities for controlling and preventing diseases. Additionally, they are allowed to receive this information for the purposes of adverse event recording (reactions to shots), tracking of products (tracking of shots), and notifying you of issues related to the product you were given. Is this legal, and can the State be indicted for breach of privacy? Yes, this is legal, and no, the State cannot be sued for it.
Most likely yes if you are subject to UK or EU laws: The EU ePrivacy directive and implementing laws such as PECR in the UK require that you obtain consent before accessing information on a user's device, unless that access is strictly necessary to perform a service requested by the user. Cookies and similar technologies such as LocalStorage are stored on the user's device. Analytics are not strictly necessary to display a website. Thus, you need to obtain valid consent before setting any analytics cookies. GDPR and ePrivacy/PECR have some interactions: Even though the cookies might technically be set by GoSquared, you as the website operator are responsible for compliance. You are the data controller, the third party analytics are usually a data processor who only process data on your behalf. You must ensure that the data processor is compliant. Even if they were a joint controller you'd be responsible for what happens on the website (relevant precedent is the Fashion ID case). While ePrivacy originally had a fairly weak concept of consent (e.g. “by continuing to use this site, you consent …”). However, the GDPR updated the definition of consent, so that valid consent must be freely given, informed, actively given, and specific. If you set cookies for different purposes in addition to analytics, users should be able to give or withhold consent for analytics independently from other purposes. Since consent must be actively given, consent is never the default, e.g. pre-ticked checkboxes are not compliant (relevant precedent is the Planet49 case). Like Google, GoSquared stores data in the US. You are causing personal data to be transferred into the US, which is an international transfer. Before it was invalidated earlier in 2020, such transfers were easy to do under the Privacy Shield adequacy decision. Now, such transfers are only legal if you sign SCCs with your data processor, and your risk assessment indicates that your user's data is sufficiently safe there, despite your processors potentially being legally unable to comply with the SCCs. Fortunately for you the UK's ICO has taken a more industry-friendly stance on this matter than other countrie's data protection agencies. Why do so many websites use Google Analytics (GA) without requesting proper consent? A variety of potential reasons: They are actually non-compliant. After all, GA is not GDPR-compliant in default settings, and Google doesn't do a good job of providing essential information. Many data protection agencies have indicated that cookie consent enforcement is not their focus. GA can be used without using cookies/LocalStorage/…, and thus without requiring consent under ePrivacy or PECR. The websites might not be subject to EU or UK laws such as ePrivacy.
Here is the state of California code regarding the question. I am sure a state by state inquiry could reveal other statutes. http://www.leginfo.ca.gov/cgi-bin/displaycode?section=pen&amp;group=00001-01000&amp;file=565-566 In California there is no specific registry but registration is performed by marking the container with a registered brand.
You are right that a visitor of a website does not expect to be tracked upon opening the website. But when using Google Analytics configured in the way explained in my other post, the visitor is not tracked. At least not in a way which violates the GDPR. You worry about the cookies. I also found this article which also does and suggests to either: change the _ga cookie to a session cookie, so it will be removed when the browser is closed. To do this, set the Cookie Expiration variable in your Google Analytics Settings to 0. completely disable cookies. (GA does not require cookies). To do this, set the storage field to none: ga('create', 'UA-XXXXX-Y', { 'storage': 'none' }); If you do not disable cookies, cookies can be used for tracking, which is more general defined in the GDPR as profiling. Profiling is defined in Art. 4 GDPR as: ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements; Art. 22(1) GDPR disallows profiling. Therefore in the settings menu from Google Analytics you have to disable data sharing and data collection. So data will only be used for the analytics function. But because you have configured to Anonymize your visitors IP Address, the part of the IP address used for this, is no longer considered personal data. This is because approx. 250 other users share the same part of the ip address which is stored, so data is not distinguishable between those 250 users. The anonymisation used by google is currently considered good enough. At least by the Dutch DPA. This might change if someone proves it is not good enough anonymized. Note that I am not a lawyer either, but I have read from multiple experts that analytics can be a "legitimate interest", the same way marketing can be a legitimate interest. This way configured the privacy impact is considered very low. It is also very important to note that a DPA consideres GA Google Analytics compliant. Even if a court would not agree in the future, you are acting in good faith if you follow those instructions, so you will probably not be fined. The DPA does currently not suggest to change the _ga cookie to a session cookie, or disable cookies completely. Note that the GDPR does not require doing anything to make it technical impossible to track someone. If a website has access to the data to track someone, but "promises" not to do that, that is fine. And rules regarding the usage of cookies in general, is not part of the GDPR, but (currently) part of the ePrivacy Directive. Only the way to ask for consent for storing cookies is defined in the GDPR.
It would merely be a &quot;jerk move&quot;. HIPAA only applies to &quot;covered entities&quot;: Healthcare Providers Health Plans Healthcare Clearing Houses (i.e. Paying for your health care) Business Associates of the Above) Source: CDC page on HIPAA
As I understand it there is no obligation to 'triage' SARs or keep data 'just-in-case' that would otherwise be deleted as a matter of routine. Can we amend or delete data following receipt of a SAR? It is our view that a SAR relates to the data you held at the time you received the request. However, in many cases, routine use of the data may result in it being amended or even deleted while you are dealing with the request. So it is reasonable for you to supply the information you hold when you respond, even if this is different to what you held when you received the request. However, it is not acceptable to amend or delete the data if you would not otherwise have done so. Under the DPA 2018, it is an offence to make any amendment with the intention of preventing its disclosure. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/
In California, psychologists are regulated under Ch 6.6 within Division 2 (Healing Arts) of the Business and Professions Code. §2902 identifies the essential restriction on the business practice, stating that &quot;A person represents himself or herself to be a psychologist when the person holds himself or herself out to the public by any title or description of services...&quot; using various forms of the word 'psychologist', as well as &quot;when the person holds himself or herself out to be trained, experienced, or an expert in the field of psychology&quot;. In order to say that you are a psychologist, you have to hold a professional psychologists's license. Likewise to hold yourself out as a nurse, you need a nurse's license. A consequence of being a licensed psychologist is that under the Confidentiality of Medical Information Act, you may assess a patient's mental state, and you must keep that information confidential. A life coach cannot make a diagnosis, and cannot prescribe cures for mental conditions. §2908 in particular allows other people to do some of what psychologists do: Nothing in this chapter shall be construed to prevent qualified members of other recognized professional groups licensed to practice in the State of California, such as, but not limited to, physicians, clinical social workers, educational psychologists, marriage and family therapists, licensed professional clinical counselors, optometrists, psychiatric technicians, or registered nurses, or attorneys admitted to the State Bar of California, or persons utilizing hypnotic techniques by referral from persons licensed to practice medicine, dentistry, or psychology, or persons utilizing hypnotic techniques which offer avocational or vocational self-improvement and do not offer therapy for emotional or mental disorders, or duly ordained members of the recognized clergy, or duly ordained religious practitioners from doing work of a psychological nature consistent with the laws governing their respective professions, provided they do not hold themselves out to the public by any title or description of services incorporating the words “psychological,” “psychologist,” “psychology,” “psychometrist,” “psychometrics,” or “psychometry,” or that they do not state or imply that they are licensed to practice psychology; except that persons licensed under Chapter 13.5 (commencing with Section 4989.10) of Division 2 may hold themselves out to the public as licensed educational psychologists. Analogously, we can talk about the law here without running afoul of UPL laws, because &quot;talking about the law&quot; is not the same as &quot;practicing law&quot;. It is a fairly formalistic distinction, but I or a life coach can talk about what would be good for your soul, as long as I don't claim to be a psychologist dispensing professional advice.
There is no general law requiring a doctor to report to the government that they have given medical treatment. On the contrary, there is a federal rule (the "Privacy Rule") that somewhat requires keeping medical information private. There may be certain instances where a report must be made, such as the obligation to report gunshot wounds or suspected child abuse. There could be entanglements regarding use of drugs that require a prescription, where there is a required paper trail.