USA – CALIFORNIA Trends and Developments Contributed by: Lowell Brown and Douglas Grimm, ArentFox Schiff LLP
viduals or groups through decisions affecting their rights, access to services, or legal status. • The inventory must include descriptions of the AI systems, their intended applications, and the data used in their training or functioning. • The law addresses concerns over AI-generated manipulative content, such as deepfakes, and aims to establish mechanisms to detect and mitigate the use of AI-generated deceptive content within state operations. • State agencies must conduct audits of bias and fairness, evaluate their AI systems, and ensure transparent AI usage. • Individuals are empowered with the right to know how AI tools impact them and the ability to dispute AI system decision-making. California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) Amendments Relating to Health Data The CCPA, as amended by the CPRA, provides aug - mented privacy protections for California residents. The CPRA introduced the concept of “sensitive per - sonal information,” which includes health data and “neural data” (information generated by measuring the activity of a consumer’s central or peripheral nervous system). These protections apply to businesses that meet specific thresholds as defined in the law. Key consumer rights under CCPA/CPRA relevant to healthcare AI include the following. • Right to know – consumers have the right to know what personal information a business collects about them, how it is used, and with whom it is shared. • Right to delete – consumers can request the dele - tion of personal information collected from them, with some exceptions. • Right to opt-out – consumers have the right to opt out of the sale or sharing of their personal informa - tion, including for targeted advertising. • Right to correct – consumers can request that businesses correct inaccurate personal information about them. • Right to limit use and disclosure of sensitive per - sonal information – consumers can direct busi - nesses to limit the use and disclosure of sensitive
personal information (including health data) for specific purposes, such as providing requested services. The California Attorney General’s office has empha - sised that AI applications must adhere to these pri - vacy laws, warning that non-compliance may result in penalties under the Unfair Competition Law. California Medical Information Act (CMIA) The venerable Confidentiality of Medical Information Act (CMIA) might be considered a “pre-HIPAA” state statute. It regulates the use and disclosure of indi - vidually identifiable medical information by licensed healthcare professionals, providers, and their con - tractors. The CMIA generally prohibits the disclosure of medical information without patient authorisation, with specific exceptions. Violations can result in both civil and criminal penalties, including fines of up to USD250,000 per violation. Not surprisingly, given the law’s premise and the CMIA’s mandates, the California Attorney General has emphasised that AI systems comply with its require - ments for safeguarding and securely using patient data. The California Attorney General’s office has stat - ed that AI systems handling patient data must adhere to the CMIA, emphasising the need to limit access and improper use of sensitive information, including data used to train AI models. Interplay Between California Laws California’s legislative approach often builds upon or supplements other frameworks, frequently impos - ing more stringent requirements. This deeply layered regulatory environment necessitates a careful and comprehensive compliance strategy for stakeholders. • The CMIA’s broader scope can apply to entities not explicitly covered by other privacy laws (eg, some digital health companies or mobile applications that store medical information). • Recent legislation introduces state-specific require - ments for transparency in AI-generated patient communications, regardless of other regulatory classifications. • The “Physicians Make Decisions Act” (SB 1120) directly regulates the use of AI in health insurance
151 CHAMBERS.COM
Powered by FlippingBook