Please take notice of the communication below which was emailed to all HealthTrust Workforce Solutions MSP staffing vendor partners earlier this week.
The California Consumer Privacy Act of 2018 (CCPA) was signed into law on June 28, 2018, and went into effect on January 1, 2020. The enforcement date for the final regulations is July 1, 2020. CCPA grants California consumers additional data privacy rights and control over their personal information, including the right to know, the right to delete, and the right to opt-out of the sale of personal information that businesses collect, as well as additional protections for minors.
Based on our review of our existing agreement and course of conduct, your company acts as a service provider to HCA or its affiliates (as defined by the CCPA), and as such is subject to and must abide by the terms of Exhibit A, attached to this letter.
If you disagree with this characterization, believe you will not be able to meet the Service Provider Obligations outlined in Exhibit A or the CCPA more generally or would like to discuss this further, please contact HWS.Communications@HealthTrustWS.com
Exhibit A: Service Provider Obligations
- HCA expects that your company will comply in all material respects with the California Consumer Privacy Act of 2018 (codified at Cal. Civ. Code § 1798.100, et seq.) ("CCPA") and all regulations and judicial opinions issued related thereto.
- If your company provides products or services to HCA and receives or collects personal information (as defined by CCPA, “PI”) from or on behalf of HCA in connection with such, then with regard to PI that your company possesses or controls in connection with the products or services provided by it to HCA, HCA expects that your company will not: (i) sell such PI; (ii) retain, use, or disclose such PI for any purpose other than the specific purpose of performing the services, or providing the product(s), in your company's agreement(s) with HCA, including retaining, using, or disclosing the PI for a commercial purpose other than providing the products or services specified in the agreement(s); or (iii) retain, use, or disclose such PI outside of the direct business relationship between your company and HCA. Notwithstanding the foregoing, but solely the extent the parties have agreed to such use in an underlying agreement, HCA understands that your company may use such PI for internal use by your company to build or improve the quality of its products or services, provided that the use does not include building or modifying household or consumer profiles, or cleaning or augmenting data acquired from another source.
- If your company provides products or services to HCA and receives or collects PI from or on behalf of HCA in connection with such, then HCA expects that your company will comply with all requests by HCA for access to, and/or deletion or modification of, PI within ten (10) business days of your company's receipt of such request from HCA, subject to exceptions permitted by the CCPA.
- If your company sells PI to HCA, HCA expects that your company will not sell PI to HCA for which the applicable consumer has exercised their right to opt out from the sale of their PI under the CCPA.
- If your company purchases PI from HCA, HCA expects that your company will not further sell such PI unless it has verified that the consumer to whom such PI relates was provided explicit notice of and an opportunity to exercise their right to opt out under Cal. Civ. Code § 115(d).
- HCA expects that your company will inform its employees, contractors, service providers, agents, and representatives of its and their CCPA compliance obligations and ensure that they comply with the CCPA and your company's obligations hereunder to the same extent as your company.
HCA expects that your company will provide all reasonable assistance to HCA to facilitate HCA's compliance with the CCPA and all other applicable laws and regulations related to consumer privacy and/or data security.
