Golden State Today

California Attorney General Rob Bonta has issued letters to eight major pharmacy chains and five health data companies, reminding them of their obligations under the state's Confidentiality of Medical Information Act (CMIA). The communication emphasizes compliance with new requirements introduced by Assembly Bill 352 (AB 352), which will be fully effective on July 1, 2024. The entities addressed include CVS Health, Walgreen Company, Cigna, Optum Rx, Walmart Stores, The Kroger Company, Rite Aid Corporation, Amazon Pharmacy, Airtable, Jotform, Spruce Health, TigerConnect, and Epic.

The legislation mandates additional protections for patients' reproductive health and gender-affirming care information. It restricts pharmacies and health data companies from sharing details about a patient's abortion with out-of-state parties unless authorized by the patient or permitted under CMIA exceptions. AB 352 also requires these organizations to implement data security measures to segregate and protect sensitive health information.

"Protecting patient information is now more imperative than ever," stated Attorney General Bonta. "Pharmacies and health data companies statewide must safeguard the privacy and confidentiality of all medical records, including those related to abortion care."

The reminder follows findings from the United States Senate Committee on Finance that revealed major pharmacy chains were disclosing protected health information (PHI) to law enforcement without warrants or patient notification. While this practice did not necessarily breach federal privacy laws, California's CMIA imposes stricter conditions.

Under CMIA and AB 352’s enhanced protections, pharmacies and healthcare firms are prohibited from providing patient medical information to most law enforcement without a warrant or prior authorization from the patient. This measure aims to ensure the privacy of Californians as well as individuals traveling to California for reproductive or gender-affirming care.

In his letter today, Attorney General Bonta requests detailed information from the addressed pharmacy chains and health data businesses regarding their adherence to CMIA and AB 352's new requirements.