LEGISLATIVE FISCAL ESTIMATE

[Second Reprint]

ASSEMBLY, No. 4170

STATE OF NEW JERSEY

219th LEGISLATURE

 

DATED: AUGUST 5, 2020

 

 

SUMMARY

 

Synopsis:

Restricts use of certain data collected for purposes of contact tracing related to COVID-19 pandemic.

Type of Impact:

State and Local Cost Increase, State Revenue Increase.

Agencies Affected:

Department of Health, County and Local Health Departments.

 

 

Office of Legislative Services Estimate

Fiscal Impact

Annual 

State Cost Increase

Indeterminate

State Revenue Increase

Indeterminate

Local Cost Increase

Indeterminate

 

·         The Office of Legislative Services (OLS) concludes that this bill would increase State costs for the Department of Health (DOH) to adopt regulations concerning the use of, and privacy protections for, individually identifiable and private health data collected as part of public health contact tracing for the novel coronavirus 2019 (COVID-19).  However, these costs would likely be minimized, to the extent that the DOH can modify and adopt existing State regulations concerning contact tracing for other communicable diseases.

·         Additional costs would likely result from a provision requiring the DOH and county and local health departments to either de-identify or delete, within 90 days of acquisition, any individually identifiable or private health data collected as part of the department’s own COVID-19 contact tracing activities.  The bill also directs the DOH and other public health departments to ensure that third-party entities contracted to conduct COVID-19 contact tracing also delete or de-identify, within 90 days of acquisition, all individually identifiable or private health data gathered as part of these contracted activities.

·         State revenues may potentially increase as a result of a provision that imposes a $10,000 penalty on any third-party entity that misuses or unlawfully discloses individually identifiable or private health data collected or shared as part of the entity’s contact tracing contract, or that fails to delete or de-identify these data within 90 days of acquisition.  Any penalties collected pursuant to the bill would be collected in the name of the Commissioner of Health.  However, absent information on the number of infractions for which the DOH might impose a penalty, the OLS cannot estimate the magnitude of the revenue increase associated with this provision.

 

BILL DESCRIPTION

 

      This bill provides that a public health entity performing contact tracing related to COVID-19, including the DOH and any county or local board of health, as well as any third party entity contracted by the public health entity to conduct contact tracing on behalf of the public health entity, may only use data gathered through these activities for the purposes of completing contact tracing and for certain authorized research purposes.

      The bill requires public health entities and contracted third parties to ensure that health and location data collected for contact tracing are de-identified or deleted from the entity’s records no later than 90 days after the date the data are received by the entity.  If the public health entity contracts with a third-party entity to perform contact tracing on the entity’s behalf, the public health entity will be required to publish the name of third-party entity on the public health entity’s Internet website or on the Internet website of the DOH and require that the third party only use contact tracing data for contact tracing or authorized research.  The Commissioner of Health is to require that systems using health and location data for contact tracing automatically de-identify or delete any individually identifiable or private health data no later than 90 days after the data is entered into the system.

      The bill defines de-identified health data to mean information that cannot be linked to an individual without additional information that is kept separately, or information that has been modified to a degree that the risk of re-identification is small.  Individually identifiable data is defined as information that can be linked to an individual without the need for additional information, or information that can be linked to an individual using other information that is readily available to or accessible by the public.  The bill expressly authorizes de-identified contact tracing data to be used by public health entities and other appropriate entities for research purposes or for other purposes related to the State’s COVID-19 response.

      Any entity in possession of de-identified contact tracing data will be required to attest to the Commissioner of Health that the entity will not attempt to re-identify the data.  A third-party entity that misuses or unlawfully discloses individually identifiable or private health data collected for contact tracing, or that retains the data beyond the date on which the data is required to be de-identified or deleted, will be liable to a civil penalty of up to $10,000, which will be collected by and in the name of the Commissioner of Health in a summary proceeding before a court of competent jurisdiction.

      The bill requires the Commissioner of Health to adopt rules and regulations concerning how public health entities and third-party entities may use data collected for contact tracing related to the COVID-19 pandemic, and how those entities will be required to ensure the security and confidentiality of that data.

 

 

FISCAL ANALYSIS

 

EXECUTIVE BRANCH

 

      None received.

OFFICE OF LEGISLATIVE SERVICES

 

The OLS finds that the provisions of this bill would increase State costs for the Commissioner of Health to adopt regulations concerning the use of, and privacy protections for, individually identifiable and private health data collected pursuant to public health contact tracing for COVID-19.  However, State costs would likely be minimized to the extent that the DOH can modify existing State regulations concerning contact tracing for individuals diagnosed with other communicable diseases, such as tuberculosis and the human immunodeficiency virus (HIV).

The DOH, as well as county and local public health departments, may also realize minimal cost increases associated with publicly publishing, on the departments’ Internet websites, the name of any third-party entities with which the DOH, or other county or local health departments, shared individually identifiable or private health data as part of a contract for COVID-19 contact tracing services.  Additional, albeit marginal, costs would result from the bill’s requirement that the DOH and other public health departments either de-identify or delete, within 90 days of acquisition, any individually identifiable or private health data collected as part of the departments’ own COVID-19 contact tracing activities.  The bill also directs the DOH and county and local health departments to ensure that third-party entities contracted to conduct COVID-19 contact tracing also delete or de-identify, within 90 days of acquisition, all individually identifiable or private health data gathered as part of these contracted activities. 

      State revenues may potentially increase as a result of a provision that imposes a $10,000 penalty on any third-party entity that misuses or unlawfully discloses individually identifiable or private health data collected or shared as part of the entity’s contact tracing contract.  This penalty would also be levied if the third-party entity does not delete or de-identify individually identifiable or private health data within 90 days of acquisition.  Any penalties collected pursuant to the bill would be collected in the name of the Commissioner of Health.  However, absent information on the number of infractions for which the DOH might impose a penalty, the OLS cannot estimate the magnitude of the revenue increase associated with this provision

 

 

Section:

Human Services

Analyst:

Anne Cappabianca

Assistant Fiscal Analyst

Approved:

Frank W. Haines III

Legislative Budget and Finance Officer

 

 

This legislative fiscal estimate has been produced by the Office of Legislative Services due to the failure of the Executive Branch to respond to our request for a fiscal note.

 

This fiscal estimate has been prepared pursuant to P.L.1980, c.67 (C.52:13B-6 et seq.).