Disclosure of Medical Information

Division 1, Part 2.6 of the Civil Code deals with the confidentiality of medical information in California. Chapter 2 concerns the disclosure of medical information by providers.

Section 56.10 states that a provider of health care, health care service plan, or contractor is prohibited from disclosing medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, with specified exceptions.

A provider of health care, a health care service plan, or a contractor is required to disclose medical information if the disclosure is compelled by any of the nine specified circumstances. A provider of health care or a health care service plan may disclose medical information as specified in any of the 24 specified manners. The terms “medical examiner, forensic pathologist, or coroner” and “school-linked services coordinator” are defined.

Section 56.1007 authorizes a provider of health care, health care service plan, or contractor to disclose to a family member, other relative, domestic partner, or a close personal friend of the patient, or any other person identified by the patient, the medical information directly relevant to that person’s involvement with the patient’s care or payment related to the patient’s health care.

In addition, a provider of health care, health care service plan, or contractor may use or disclose medical information to notify, or assist in the notification of, including identifying or locating, a family member, a personal representative of the patient, a domestic partner, or another person responsible for the care of the patient of the patient’s location, general condition, or death. 

If the patient is not present, or the opportunity to agree or object to the use or disclosure cannot practicably be provided because of the patient’s incapacity or an emergency circumstance, the provider of health care, health care service plan, or contractor may, in the exercise of professional judgment, determine whether the disclosure is in the best interests of the patient and, if so, disclose only the medical information that is directly relevant to the person’s involvement with the patient’s health care.

A provider of health care, health care service plan, or contractor may use professional judgment and its experience with common practice to make reasonable inferences of the patient’s best interest in allowing a person to act on behalf of the patient to pick up filled prescriptions, medical supplies, X-rays, or other similar forms of medical information.

Section 56.101 states that every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information is required to do so in a manner that preserves the confidentiality of the information contained therein. An electronic health record system or electronic medical record system are required to do all of the specified actions.

Section 56.102 provides that a pharmaceutical company may not require a patient, as a condition of receiving pharmaceuticals, medications, or prescription drugs, to sign an authorization, release, consent, or waiver that would permit the disclosure of medical information that otherwise may not be disclosed, unless the disclosure is for one of the four specified purposes. A pharmaceutical company may not disclose medical information provided to it without first obtaining a valid authorization from the patient.

Section 56.103 allows a provider of health care to disclose medical information to a county social worker, a probation officer, a foster care public health nurse, or any other person who is legally authorized to have custody or care of a minor for the purpose of coordinating health care services and medical treatment provided to the minor, including the sharing of information related to screenings, assessments, and laboratory tests necessary to monitor the administration of psychotropic medications.

Section 56.104 explains that no provider of health care, health care service plan, or contractor may release medical information to persons or entities who have requested that information and who are authorized by law to receive that information if the requested information specifically relates to the patient’s participation in outpatient treatment with a psychotherapist, unless the person or entity requesting that information submits to the patient and to the provider of health care, health care service plan, or contractor a written request, signed by the person requesting the information or an authorized agent of the entity requesting the information, that includes all four specified items. This section does not apply to any of three specified items of information.

Section 56.105 provides that, whenever prior to the service of a complaint upon a defendant in any action arising out of the professional negligence of a person holding a valid physician’s and surgeon’s certificate, the demand or offer must be accompanied by an authorization to disclose medical information to persons or organizations insuring, responsible for, or defending professional liability that the certificate holder may incur. 

Section 56.106 explains that a psychotherapist who knows that a minor has been removed from the custody of his or her parent or guardian cannot release the mental health records of the minor patient and not disclose mental health information about that minor patient based upon an authorization to release those records signed by the minor’s parent or guardian.

This restriction does not apply if the juvenile court has issued an order authorizing the parent or guardian to sign an authorization for the release of the mental health records or the information about the minor patient after finding that an order would not be detrimental to the minor patient. The terms “mental health records” and “psychotherapist” are defined.

Section 56.107 states that a health care service plan is required to take the five specified steps to protect the confidentiality of a subscriber’s or enrollee’s medical information.

Section 56.108 prohibits a provider of health care, health care service plan, contractor, or employer from releasing medical information related to an individual seeking or obtaining an abortion in response to a subpoena or request if that subpoena or request is based on either another state’s laws that interfere with a person’s rights under the Reproductive Privacy Act or a foreign penal civil action.

Also, a provider of health care, health care service plan, contractor, or employer cannot release medical information that would identify an individual or that is related to an individual seeking or obtaining an abortion to law enforcement for either of the specified purposes, unless that release is pursuant to a subpoena not otherwise prohibited.

Section 56.109 prohibits a provider of health care, health care service plan, or contractor from releasing medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any subpoena or request, including a foreign subpoena, based on another state’s law that interferes with an individual’s right to seek or obtain gender-affirming health care or gender-affirming mental health care or authorizes a person to bring a civil or criminal action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.

Section 56.110 prohibits a provider of health care, health care service plan, pharmaceutical company, contractor, or employer from knowingly disclosing, transmitting, transferring, sharing, or granting access to medical information in an electronic health records system or through a health information exchange that would identify an individual and that is related to an individual seeking, obtaining, providing, supporting, or aiding in the performance of an abortion that is lawful under the laws of this state to any individual or entity from another state, unless the disclosure, transmittal, transfer, sharing, or granting of access is authorized under any of the four specified conditions.

Section 56.11 explains that any person or entity that wishes to obtain medical information, other than a person or entity authorized to receive medical information, is required to obtain a valid authorization for the release of this information. An authorization for the release of medical information by a provider of health care, health care service plan, pharmaceutical company, or contractor is valid if it meets the nine specified conditions.

Section 56.12 states that, upon demand by the patient or the person who signed an authorization, a provider of health care, health care service plan, pharmaceutical company, or contractor possessing the authorization is required to furnish a true copy of it.

Section 56.13 provides that a recipient of medical information pursuant to an authorization as provided by this chapter may not further disclose that medical information except in accordance with a new authorization.

Section 56.14 says that a provider of health care, health care service plan, or contractor that discloses medical information pursuant to the authorizations required must communicate to the person or entity to which it discloses the medical information any limitations in the authorization regarding the use of the medical information.

Section 56.15 explains that nothing in this part is to be construed to prevent a person who could sign the authorization from cancelling or modifying an authorization. However, the cancellation or modification is effective only after the provider of health care actually receives written notice of the cancellation or modification.

Section 56.16 states that, unless there is a specific written request by the patient to the contrary, nothing in this part is to be construed to prevent a general acute care hospital, upon an inquiry concerning a specific patient, from releasing at its discretion any of the specified information.