Source: http://www.privacyandcybersecuritylaw.com/
Timestamp: 2019-04-23 21:56:09+00:00

Document:
The phrase “medical information” under the CCPA is defined by California Civil Code § 56.05(j), which defines the phrase to mean “any individually identifiable information” in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment.” Cal. Civ. Code § 56.05(j). “Individually identifiable” under Civil Code § 56.05(j) means that the medical information “includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individual’s identity.” Id.
 The phrase “protected health information” under the CCPA is defined by 45 C.F.R. § 160.103 to mean “individually identifiable health information” that is: (i) transmitted by electronic media; (ii) maintained in electronic media; or (iii) transmitted or maintained in any other form or medium. Individually identifiable health information is defined as “information that is a subset of health information, including demographic information collected from an individual” and: (1) is created or received by a health care provider, health plan, employer, or health care clearinghouse; (2) relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (3) that identifies the individual or there is a reasonable basis to believe the information can be used to identify the individual. The definition of “protected health information” excludes individually identifiable health information: (i) in education records covered by the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g); (ii) records described at 20 U.S.C. § 1232g(a)(4)(B)(iv); (iii) employment records held by a covered entity in its role as employer; and (iv) regarding a person who has been deceased for more than 50 years. 45 C.F.R. § 160.10(1)-(2).
 The GLBA places restrictions on how covered entities collect, use, and disclose certain “nonpublic personal information” relating to consumers. “Nonpublic personal information” is defined under the GLBA as “personally identifiable financial information – (i) provided by a consumer to a financial institution; (ii) resulting from any transaction with the consumer or any service performed for the consumer; or (iii) otherwise obtained by the financial institution. 18 U.S.C. § 6809(4)(A). Such information includes any list, description, or other grouping of consumers (and publicly available information pertaining to them) that is derived using any nonpublic personal information other than publicly available information. 18 U.S.C. § 6809(4)(B). The GLBA’ implementing regulations, promulgated and enforced by the Federal Trade Commission (“FTC”). The FTC adopts the same definition of nonpublic personal information, and defines “personally identifiable financial information” to mean any information: (i) a consumer provides to obtain a financial product or service from the covered entity; (ii) about a consumer resulting from any transaction involving a financial product or service between the covered entity and the consumer; or (iii) the covered entity otherwise obtains about a consumer in connection with providing a financial product or service to the consumer. 16 CFR § 313.3(o)(1)(i)-(iii). Examples of personally identifying financial information include: (A) information a consumer provides to the covered entity on an application to obtain a loan, credit card, or other financial product or service; (B) account balance information, payment history, overdraft history, and credit or debit card purchase information; (C) the fact that an individual is or has been one of the covered entity’s customers or has obtained a financial product or service from the covered entity; (D) any information about the consumer if it is disclosed in a manner that indicates the individual is or has been a consumer; (E) any information that a consumer provides to the covered entity or that the covered entity or its agent otherwise obtain in connection with collecting on, or servicing, a credit account; (F) any information the covered entity collects through an Internet “cookie” (an information collecting device from a web server); and (G) information from a consumer report. Information not included as personally identifiable financial information includes information that does not identify a consumer, “such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names, or addresses.” 16 C.F.R. § 313.3(o)(2)(i)-(ii).
 The California Financial Information Privacy Act provides for greater privacy protections than those provided in the GLBA, and likewise regulates the collection, usage, and storage of “nonpublic personal information.” Cal. Fin. Code § 4051. The CFIPA defines “nonpublic personal information” the same as the GLBA, and the phrase “personally identifiable financial information” the same as the GLBA and its implementing regulations. Cal. Fin. Code §§ 4052(a)-(b).
 “Personal information” is defined under the DPPA means “information that identifies an individual, including an individual’s photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information, but does not include information on vehicular accidents, driving violations, and driver’s status.

References: § 56
 § 56
 § 56
 § 160
 § 1232
 § 1232
 § 160
 § 6809
 § 6809
 § 313
 § 313
 § 4051