Restrictions for Public Data Products.

22 CCR 97416

Source text

12 segments

22 CCR 97416

§ 97416. Restrictions for Public Data Products.

(a)

Data users shall not include PII or record-level information about patients or individual consumers in their public data products. Data users shall only include aggregated and deidentified data about patients or individual consumers in their public data products.

(1)

To deidentify aggregated data, data users must use the methodology stated in Sections 4 (regarding Steps 1 to 4), 4.1 to 4.4, 5.1 to 5.4, 6.1, 6.2, 6.4, and 9 of the California Health and Human Services Agency's “Data De-Identification Guidelines (DDG),” dated September 23, 2016. Data users shall use the “Publication Scoring Criteria” stated in Section 4.3 of the DDG as their method to assess potential risk. These sections are hereby incorporated by reference.

(b)

Data users shall submit draft public data products with any information about patients or individual consumers to the Department. The Department shall review these draft public data reports for compliance with subsection (a).

(1)

Data users shall submit with their draft public data products documentation regarding how they aggregated and deidentified the PII or record-level information about patients or individual consumers.

(2)

Data user shall not release public data products unless the Department approved the release of the public data product in writing. If the Department does not approve a draft public data product, it shall notify the data user in writing of its decision and the reasons for its decision.

(c)

Data users shall not include PII or record-level data regarding individuals who are not patients or individual consumers in their public data products if the Department determines that the disclosure would be a mandatory reason for denial under section 97388(b) or if the Department determines that there is good cause to prevent the disclosure.

(1)

Data Users shall notify the Department if their draft public data products include PII or record-level information regarding individuals who are not patients or individual consumers. This notice shall describe the PII or record-level information.

(2)

The Department may require its review and approval of these draft public data products before release for compliance with this subsection. Data users shall not release the public data product before the Department notifies the data user whether review is required.

(3)

If review is required, the following shall apply:

(A)

Data users shall not release draft public data products under review unless the Department approved the release of the public data product in writing.

(B)

If the Department does not approve the draft public data product, it shall notify the data user in writing of its decision and the reasons for its decision. The Department may require information about individuals to be aggregated or deidentified pursuant to subsection (a) before release.

Source outline

11 anchors in this source