Where HIPAA Stops, CCPA Begins
Categories: IP
The California Consumer Privacy Act (CCPA) applies to a wide range of for-profit businesses that collect the personal information of California residents. However, CCPA includes a convenient carve-out for HIPAA-covered entities and business associates: it doesn’t apply to protected health information, or PHI, as that term is defined under HIPAA.
This carve-out is not as broad as it appears, though, and covered entities and business associates that are otherwise in scope for CCPA (see our prior alert) must still figure out where and how they handle “personal information” that isn’t PHI. They should also note that some types of PHI (or former PHI) may be subject to CCPA despite the carve-out.
