Can I collect device information from participants in California? What are the requirements?

Based on the context documents provided, it appears that the query is related to collecting device information from participants in California in the context of health information exchange.

Permitted Purposes for Exchanging Health Information.

According to 22 CACR Section 126050, Demonstration Project Participants that disclose individual health information through a Health Information Organization (HIO) or an independent directed exchange, or use individual health information in an affiliated organization shall be limited to certain permitted purposes. These include treatment, reporting to public health officials for immunizations, bio-surveillance and mandated reporting, quality reporting for meaningful use to Centers for Medicare and Medicaid Services and the California Department of Health Care Services, and HIPAA mandated transactions consistent with 45 C.F.R. § 162.900 through 45 C.F.R. § 162.1802 for transaction standards and code sets.

Security Requirements — General.

Furthermore, 22 CACR Section 126070 outlines the security requirements for Demonstration Project Participants. All participants must protect the confidentiality, integrity, and availability of all electronic individual health information (IHI) they create, receive, maintain, or transmit. They must also protect against any reasonably anticipated threats or hazards to the security or integrity of such information, and protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under California law.

Based on the above context documents, it is unclear whether collecting device information from participants in California is permitted or not. However, it is clear that any collection of electronic IHI must comply with the security requirements outlined in 22 CACR Section 126070.

Therefore, it is recommended that you consult with a legal expert or regulatory authority to determine the specific requirements for collecting device information from participants in California in the context of health information exchange.

^{[1.2][1.3][1.5][1.8]}

Source(s):

• [1.2] Permitted Purposes for Exchanging Health Information.
• [1.3] Security Requirements — General.
• [1.5] Requests to Develop Alternative Requirements.
• [1.8] Applicability of Regulations.

Jurisdiction

California

• Privacy