California medical privacy rules govern how many health care providers, health plans, and related businesses handle personal health information. The main state law, the Confidentiality of Medical Information Act (CMIA), works alongside the federal Health Insurance Portability and Accountability Act (HIPAA) and other California protections. Knowing which rules apply can help patients make informed choices about records, disclosures, and privacy concerns.
How California Medical Privacy Laws Work
Medical privacy in California is not governed by one rule alone. The CMIA, found mainly in California Civil Code sections 56–56.37, restricts the use and disclosure of medical information by covered providers, health plans, and certain contractors. HIPAA establishes federal privacy and security requirements for covered health care entities and their business associates. Other state and federal laws add protections for specific kinds of information, including mental health, HIV, and substance use treatment records.
These laws overlap, but they do not cover every organization or type of data in the same way. A hospital may be subject to both HIPAA and the CMIA, while a consumer health app that is not acting for a HIPAA-covered entity may fall outside HIPAA. California’s consumer privacy laws may apply to some businesses and data that HIPAA does not cover, although exemptions and exclusions can affect the result.
For patients, the practical question is often not simply “Is this information private?” but who holds it, what kind of information it is, and why it is being used or shared. A provider’s privacy notice can explain its practices, but the notice does not replace legal requirements.
What Counts As Medical Information?
Under the CMIA, medical information generally includes individually identifiable information about a person’s medical history, mental or physical condition, or treatment. It can appear in a paper chart, electronic health record, billing file, or communication with a provider. Information may also qualify when it is held by a health care provider or health plan and can be linked to a patient.
HIPAA uses the term protected health information (PHI) for individually identifiable health information held or transmitted by a covered entity or business associate, subject to specific exclusions. PHI can include diagnoses, test results, treatment details, appointment information, and payment records. Properly de-identified information is generally treated differently under HIPAA because it is not reasonably identifiable as belonging to an individual.
Information that seems ordinary can reveal something private when connected to a person. A prescription record, a specialist appointment, or a claim can disclose health-related details even if it contains no full medical chart. The context and the identity of the organization holding the information matter.
When Providers May Use Or Disclose Health Information
California providers generally need a patient’s authorization to disclose medical information unless a law permits or requires the disclosure. HIPAA also allows certain uses and disclosures without written authorization, including many disclosures for treatment, payment, and health care operations. These permissions are limited by applicable state law and by rules governing especially sensitive records.
Examples of disclosures that may be allowed or required under particular conditions include:
- Care coordination: Sharing relevant information with another provider involved in a patient’s treatment.
- Payment and operations: Using information for billing, claims, quality review, or other permitted administrative functions.
- Public health and safety: Reporting certain diseases or responding to specific threats, as authorized by law.
- Legal requirements: Responding to a valid court order, warrant, or other legally sufficient process, subject to applicable restrictions.
- Patient-directed sharing: Sending records to a person or organization when the patient has provided the required authorization.
A request from an employer, family member, insurer, or law enforcement agency does not automatically entitle that party to a patient’s records. The provider must assess the request under relevant law. Patients can ask what information was shared, with whom, and under what authority, though access to an accounting of disclosures is subject to legal exceptions and varying rules.
Patient Rights To Access And Manage Records
Patients generally have the right to inspect and obtain copies of records held by covered providers, subject to defined exceptions. Under HIPAA, a covered entity ordinarily must act on an access request within 30 calendar days; it may use one extension of up to 30 additional days if it provides the required notice. California law can provide a shorter response period for certain records. Patients should make requests in writing and ask the provider to explain its process, fees, and expected timing.
Access rights do not always mean access to every document in a provider’s possession. HIPAA, for example, excludes certain materials from the designated record set, such as psychotherapy notes kept separately from the medical record. Other limited exceptions may apply. If a request is denied, the provider generally must explain the basis and describe any available review or complaint process.
Patients can also ask a covered provider to correct information they believe is inaccurate or incomplete. Under HIPAA, the provider may deny an amendment request in specified circumstances, such as when it did not create the record or considers the record accurate and complete. A patient who disagrees can typically submit a statement of disagreement for inclusion in the record.
Patients may request confidential communications, such as asking a provider to contact them at a particular address or phone number. HIPAA requires covered health plans and providers to accommodate reasonable requests when the patient clearly states that disclosure could endanger them. California law may provide additional protections in particular circumstances, including for certain sensitive services.
Special Protections For Sensitive Health Information
Mental Health And Psychotherapy Records
Mental health information is subject to general privacy rules, and some records have additional limits. HIPAA treats psychotherapy notes separately when they meet its definition, and disclosure often requires a specific authorization. California law also regulates mental health records, with rules that vary by record type, provider, and purpose. A general release may not be sufficient for every category of sensitive information.
HIV, Genetic, And Substance Use Information
California law imposes particular requirements on disclosures of HIV test results and certain genetic information. Federal rules under 42 CFR Part 2 can provide enhanced confidentiality for records from federally assisted substance use disorder programs. These protections have detailed exceptions, and they do not mean that every reference to substance use in any medical record is governed identically.
Reproductive And Sexual Health Information
California has enacted protections addressing reproductive health care information and cooperation with out-of-state investigations. State law limits certain disclosures and responses to requests connected with legally protected reproductive or gender-affirming health care. Separate laws may also protect minors’ ability to consent to specified confidential services. The applicable rule depends on the service, the patient’s circumstances, and the request being made.
California Consumer Privacy Laws And Health Data
The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives qualifying consumers rights concerning certain personal information held by covered businesses. These may include rights to know, delete, correct, and limit certain uses or disclosures of sensitive personal information. However, the law contains important exclusions, including for some information governed by HIPAA or the CMIA, and it does not apply to every business.
Health-related data collected by a non-HIPAA company may not receive HIPAA protection simply because it concerns health. At the same time, it may be subject to California consumer privacy rules or other state and federal requirements. California’s Confidentiality of Medical Information Act amendments addressing businesses that maintain medical information may also be relevant in some situations. Coverage depends on the organization, the information, and the particular statutory provisions.
Before sharing health information through an app, website, wearable device, or online service, patients can review the privacy policy, examine what data is collected, and check whether information is shared with advertisers or other third parties. A provider’s portal and an independent health app may have different legal protections.
Privacy Breaches And What Patients Can Do
A breach may involve a lost device, misdirected email, unauthorized chart access, or improper disclosure to another person. HIPAA generally requires covered entities to notify affected individuals after a breach of unsecured PHI, with timing and additional reporting duties depending on the circumstances. California also has breach-notification requirements for certain personal information, including specified medical and health insurance information. Not every privacy mistake legally qualifies as a reportable breach.
If a patient suspects improper access or disclosure, practical steps include:
- Contact the provider’s privacy officer or health plan and describe the information, date, and suspected disclosure.
- Ask for the organization’s findings, any corrective action, and whether the incident triggers a formal breach notification.
- Keep copies of letters, portal messages, and other communications.
- Consider filing a complaint with the U.S. Department of Health and Human Services Office for Civil Rights (OCR) if a HIPAA-covered entity may have violated federal privacy rights.
- For a possible California law violation, consult the appropriate state agency or a qualified attorney about available complaint options.
OCR complaints generally must be filed within 180 days of when the complainant knew of the alleged violation, although OCR may extend the deadline for good cause. A complaint should identify the organization and explain what happened. Filing a complaint does not guarantee a particular outcome, and the agency’s authority depends on the law involved.
Possible Consequences For Privacy Violations
Consequences depend on the statute, the type of organization, and the facts. HIPAA enforcement can include corrective action and civil monetary penalties; criminal penalties may apply to certain knowing conduct. California’s CMIA also provides for penalties and, in specified circumstances, civil claims. The availability and amount of damages depend on statutory requirements, proof, and the particular violation.
Patients should avoid assuming that every unauthorized disclosure creates an automatic right to compensation. A privacy concern may be addressed through a provider’s internal process, a regulatory complaint, or legal action, but each route has different deadlines and standards. Individual legal advice may be useful when the disclosure caused significant harm or involved highly sensitive information.
Practical Ways To Protect Medical Privacy
Patients can reduce avoidable exposure by using secure patient portals, enabling multifactor authentication when available, and avoiding public computers for sensitive records. They can confirm a recipient’s identity before authorizing record transfers and review forms carefully for the scope, purpose, and expiration of a release.
When a family member helps manage care, patients can ask the provider what authorization is needed and whether access can be limited to particular records or functions. They can also review insurance communications and request confidential contact methods when safety or privacy is a concern.
For a dispute, keeping a clear written record helps. A concise request should identify the record or disclosure at issue, state the action sought, and include dates and relevant correspondence. Providers’ privacy offices can explain their procedures, while official agency resources can clarify complaint routes and legal rights.
Reliable Sources For California Medical Privacy
- California Civil Code, Confidentiality of Medical Information Act
- U.S. Department of Health and Human Services: HIPAA for Individuals
- HHS guidance on individuals’ right to access health information
- California Attorney General: California Consumer Privacy Act
- HHS Office for Civil Rights: Filing a HIPAA complaint
Important: This overview is general information, not legal advice. California medical privacy rules can change, and specific rights depend on the records, organization, and circumstances involved.