California Confidentiality of Medical Information Act

California Confidentiality of Medical Information Act
Name	California Confidentiality of Medical Information Act
Enacted by	California Legislature
Citation	California Civil Code §§ 56–56.37
Territorial extent	California
Enacted	1981
Amended	multiple times
Status	in force

California Confidentiality of Medical Information Act

The California Confidentiality of Medical Information Act is a state statute enacted to protect the privacy of individual medical information in California. It establishes rights for patients, duties for health care providers, and limits on disclosure by insurers, health plans, and third parties. The Act operates alongside federal statutes and has shaped litigation involving privacy, technology companies, and health care institutions.

Overview and Purpose

The Act was enacted by the California Legislature to address concerns raised by advances in electronic recordkeeping and third‑party data handling, drawing on public attention from cases involving Roe v. Wade‑era privacy debates and later technological shifts exemplified by entities like Google and Facebook. Its purpose is to preserve confidentiality of medical information held by specified entities such as physicians, hospitals, and health care service plans and to provide statutory remedies for unauthorized disclosures, reflecting policy influences from state actors including the California Attorney General and regulatory frameworks developed by the Department of Managed Health Care.

Definitions and Scope

Key defined terms identify who is covered and what information is protected. The Act applies to records maintained by licensed physicians, dentists, pharmacists, hospitals, health insurers including Kaiser Permanente, and certain contractors of those entities. "Medical information" under the Act encompasses identifiable information about diagnosis, treatment, medical history, and payment related to health care providers such as Stanford Health Care and UCLA Health. The scope excludes certain public health reporting to agencies like the California Department of Public Health and data collected by entities outside the Act's enumerated classes, which can implicate actors such as Centers for Disease Control and Prevention when federal reporting is required.

Privacy Protections and Patient Rights

The Act grants patients rights including the right to reasonable security against unauthorized disclosure, the right to obtain an accounting of disclosures, and the right to seek civil remedies. It requires covered entities such as Sutter Health and Cedars-Sinai Medical Center to implement safeguards for records and prohibits disclosures without patient authorization, except as specified. The law interacts with patient advocacy groups like ACLU of Northern California and California Medical Association in shaping interpretations of confidentiality and consent. Individuals may assert statutory causes of action and request injunctive relief in state courts such as the California Supreme Court and various California Courts of Appeal.

Permitted Uses, Disclosures, and Exceptions

The Act delineates permitted disclosures including those for treatment, payment, and health care operations among covered entities; mandated reporting to agencies like the California Department of Public Health; and disclosures pursuant to subpoenas or court orders from tribunals such as United States District Court for the Northern District of California when judicial processes apply. Exceptions also cover communications with public health authorities during emergencies declared by the Governor of California, and disclosures to law enforcement under limited statutory conditions. Specific exceptions have been litigated in contexts involving employers like Walmart and insurers such as Anthem Blue Cross.

Enforcement, Penalties, and Remedies

Enforcement mechanisms include civil liability with statutory damages, injunctive relief, and costs and attorney fees for prevailing plaintiffs. The California Attorney General can seek enforcement in instances implicating state interests, and individuals may bring private actions in state courts. Remedies have been awarded against entities ranging from individual practitioners to large institutions like Health Net for breaches. Penalties can be both compensatory and statutory, and in some cases punitive damages have been pursued consistent with California tort law precedents such as those involving privacy torts litigated before the California Supreme Court.

Relationship to HIPAA and Other Laws

The Act operates alongside the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) but is more restrictive in scope for state‑regulated entities; where HIPAA sets a federal floor, the Act can provide additional protections. Interactions arise with federal regulators like the Office for Civil Rights (OCR) and statutes including the California Confidentiality of Medical Information Act's interplay with state statutes governing mental health records, California Welfare and Institutions Code provisions, and mandates from agencies like the Department of Health and Human Services. Covered entities must navigate both HIPAA rules and state requirements when handling protected health information in systems used by organizations such as Apple and Microsoft.

Notable Litigation and Policy Developments

Significant litigation has arisen over the Act in cases involving disclosure of electronic records, data mining by technology firms, and subpoenas for medical records in criminal investigations. Key defendants and plaintiffs have included hospitals, insurers, and tech companies, with notable decisions from the California Supreme Court and federal courts interpreting preemption, standing, and statutory damages. Policy developments reflect legislative amendments and regulatory guidance influenced by high‑profile data breaches at entities like Anthem Inc. and privacy campaigns led by organizations such as Electronic Frontier Foundation and Privacy Rights Clearinghouse. Ongoing debates involve balancing public health needs during emergencies declared by the Governor of California and individual privacy rights championed by civil liberties groups.

Category:California law Category:Health privacy law Category:Medical confidentiality