(a)

1. (1) The Birth Defects Monitoring Program, within the State Department of Public Health, shall collect and store any umbilical cord blood samples it receives from hospitals for storage and research. For purposes of ensuring financial stability, the Birth Defects Monitoring Program shall ensure that the following conditions, alone or in combination, are met:

   1. (A) The fees paid by researchers pursuant to subdivision (c) shall be used for, and be sufficient to cover the cost of, collecting and storing blood samples, including umbilical cord blood samples.
   2. (B) The department receives confirmation that a researcher has requested umbilical cord blood samples from the Birth Defects Monitoring Program for research or has requested umbilical cord blood samples to be included within a request for pregnancy or newborn blood samples through the program and has provided satisfactory evidence that adequate funding will be provided to the department from the fees paid by the researcher for the request.
   3. (C) The department receives federal grant moneys to pay for initial startup costs for the collection and storage of umbilical cord blood samples.
2. (2) The department may limit the number of umbilical cord blood samples the program collects each year.

(b)

1. (1) All information relating to umbilical cord blood samples collected and utilized by the department shall be confidential, and shall be used solely for the purposes of the program, or, if approved by the department, research. Access to confidential information shall be limited to authorized persons who agree, in writing, to maintain the confidentiality of that information. Notwithstanding any other provision of law, when the blood samples specified in subdivision (c), including those samples with any information identifying the person from whom the samples were obtained, are stored, processed, analyzed, or otherwise shared for research purposes with nondepartment staff, those samples may be shared by the program with department-authorized researchers for research purposes, and department representatives approved by the department, subject to the confidentiality and security requirements for confidential information established in this section and in Section 103850.
2. (2) The department shall maintain an accurate record of all persons who are given confidential information pursuant to this section, and any disclosure of confidential information shall be made only upon written agreement that the information will be kept confidential, used for its approved purpose, and not be further disclosed.
3. (3) A person who, in violation of a written agreement to maintain confidentiality, discloses information provided pursuant to this section, or who uses information provided pursuant to this section in a manner other than as approved pursuant to this section may be denied further access to confidential information maintained by the department, and shall be subject to a civil penalty not exceeding one thousand dollars ($1,000). The penalty provided in this section does not limit or otherwise restrict a remedy, provisional or otherwise, provided by law for the benefit of the department or a person covered by this section.

(c) In order to implement this section, the department shall establish fees in an amount that shall not exceed the costs of administering the program and the collection and storage of these samples, which the department shall collect from researchers who have been approved by the department and who seek to use the following types of blood samples for research:

1. (1) Umbilical cord blood.
2. (2) Pregnancy blood collected by the Genetic Disease Screening Program, and stored by the Birth Defects Monitoring Program.
3. (3) Newborn blood collected by the Genetic Disease Screening Program.

(g) The department, any entities approved by the department, and researchers shall maintain the confidentiality of patient information and blood samples in accordance with existing law and in the same manner as other medical record information with patient identification that they possess, and shall use the information only for the following purposes:

1. (1) Research to identify risk factors for children’s and women’s diseases.
2. (2) Research to develop and evaluate screening tests.
3. (3) Research to develop and evaluate prevention strategies.
4. (4) Research to develop and evaluate treatments.

(h)

1. (1) For purposes of ensuring the security of a donor’s personal information, before any blood samples are released pursuant to this section for research purposes, the State Committee for the Protection of Human Subjects (CPHS) shall determine if all of the following criteria have been met:

   1. (A) The department, contractors, researchers, or other entities approved by the department have provided a plan sufficient to protect personal information from improper use and disclosures, including sufficient administrative, physical, and technical safeguards to protect personal information from reasonable anticipated threats to the security or confidentiality of the information.
   2. (B) The department, contractors, researchers, or other entities approved by the department have provided a sufficient plan to destroy or return all personal information as soon as it is no longer needed for the research activity, unless the program contractors, researchers, or other entities approved by the department have demonstrated an ongoing need for the personal information for the research activity and have provided a long-term plan sufficient to protect the confidentiality of that information.
   3. (C) The department, contractors, researchers, or other entities approved by the department have provided sufficient written assurances that the personal information will not be reused or disclosed to a person or entity, or used in a manner not approved in the research protocol, except as required by law or for authorized oversight of the research activity.

2. (2) As part of its review and approval of the research activity for the purpose of protecting personal information held in agency databases, CPHS shall accomplish at least all of the following:

   1. (A) Determine whether the requested personal information is needed to conduct the research.
   2. (B) Permit access to personal information only if it is needed for the research activity.
   3. (C) Permit access only to the minimum personal information necessary for the research activity.
   4. (D) Require the assignment of unique subject codes that are not derived from personal information in lieu of social security numbers if the research can be conducted without social security numbers.
   5. (E) If feasible, and if cost, time, and technical expertise permit, require the agency to conduct a portion of the data processing for the researcher to minimize the release of personal information.