Meta description: Learn how California Welfare and Institutions Code Section 5328 protects mental health records, who may receive information, and when disclosure is permitted.
California Welfare and Institutions Code Section 5328 sets strong confidentiality rules for many mental health records and information. The statute generally limits disclosure, but it does not make records inaccessible in every situation. Patients, providers, courts, and certain agencies may have access under specific conditions. Understanding the rule requires looking at the kind of information involved, the reason for disclosure, and the particular exception that applies. This guide explains the statute’s scope, common exceptions, practical limits, and steps for requesting or sharing records.
What California WIC Section 5328 Covers
California WIC Section 5328 is a state confidentiality law concerning information and records obtained while providing services under Division 5 of the Welfare and Institutions Code. Division 5 includes California’s principal statutes for mental health treatment and related services. The law’s basic rule is that covered information and records are confidential and may be disclosed only as the statute allows.
The protection can reach more than a formal medical chart. Depending on the circumstances, it may cover information about a person’s receipt of services, treatment, diagnosis, or other details learned during care. The statute’s reach depends on how the information was obtained and which services are involved. It should not be assumed that every document held by every behavioral health provider is governed solely by WIC 5328.
WIC 5328 is distinct from other privacy rules that may apply at the same time. The federal Health Insurance Portability and Accountability Act (HIPAA), California medical privacy laws, and specialized confidentiality laws can impose additional requirements. For substance use disorder treatment records, federal regulations under 42 C.F.R. Part 2 may also apply. A disclosure that is permitted under one law is not automatically permitted under every other law.
Read California WIC Section 5328 for the current statutory text. Because the section contains multiple exceptions and can be amended, its exact language—not a general summary—controls.
The General Rule: Confidentiality Comes First
The starting point under California WIC 5328 is not that mental health information can be shared whenever it seems useful. It is that covered information is confidential unless a valid legal basis permits disclosure. A provider or agency should identify the applicable exception, confirm its conditions, and share no more information than the exception authorizes.
This rule matters in ordinary situations as well as highly sensitive ones. A family member may be involved in a person’s care, but that relationship alone does not necessarily authorize access to confidential records. Likewise, an employer, school, landlord, insurer, or other organization does not gain access simply by asking. The person or organization holding the records must follow the governing law and its own applicable procedures.
Confidentiality does not necessarily prevent a provider from using information internally to deliver care. Treatment teams may need relevant information to assess needs, coordinate services, and maintain records. But internal access should still be limited to people with a legitimate role, consistent with applicable privacy rules and organizational safeguards.
Common Exceptions to WIC 5328 Confidentiality
Section 5328 includes specific circumstances in which disclosure may be permitted. These provisions are not blanket permission to distribute an entire record. Their scope can depend on who is requesting information, the purpose, the patient’s status, and any required authorization or court process.
Disclosure to the person receiving services
The statute provides routes for a person to obtain information about their own care. Requests are usually handled through the provider or agency’s records process. Other laws, including HIPAA, may also provide a right to inspect or obtain copies of certain records, subject to applicable exceptions. The process may require identity verification and a written request, and fees or timelines may be governed by law.
Access to one’s own information does not necessarily mean every item must be released in the same way. Laws may treat psychotherapy notes, records created for legal proceedings, or certain safety-related material differently. Providers should explain any denial, limitation, or redaction and identify the legal basis rather than relying on a general claim that all mental health records are confidential.
Disclosure with authorization
A patient may authorize disclosure to another person or organization, such as a family member, another clinician, or an attorney. A valid authorization should identify the information to be released, the recipient, the purpose, and any expiration or other required terms. A broad or unclear form can create disputes about what was actually authorized.
Consent is not a universal solution. The authorization must satisfy the laws that apply to the records, and certain kinds of information may require additional protections. For example, records subject to 42 C.F.R. Part 2 can have specific consent and disclosure requirements. A provider should check all applicable rules before releasing information, even if a general release form has been signed.
Care coordination and other providers
Some statutory exceptions allow disclosures to support treatment or care coordination, including communication with appropriate health care providers in circumstances specified by law. Such sharing can help prevent duplicated services, clarify medications, and support continuity of care. It does not mean that every clinician may automatically receive a complete mental health file.
The recipient, purpose, and information shared should fit the relevant exception. When practical, providers can share the information needed for the immediate care purpose rather than sending unrelated history. HIPAA’s treatment provisions and California’s more protective rules may interact, so a provider should not rely on a HIPAA provision without checking state law.
Family members, guardians, and representatives
A legally authorized representative, guardian, or conservator may have rights or responsibilities that affect access, depending on the person’s legal status and the governing provision. The authority should be verified; a family relationship by itself is not the same as legal authority. A provider may need documents showing the scope of a representative’s role.
Family involvement can also be important for practical support, but it does not eliminate the patient’s privacy rights. Providers may be able to receive information from relatives without confirming treatment or disclosing protected details. When a patient agrees to family participation, the team can clarify what may be shared and with whom.
Court orders and legal proceedings
WIC 5328 permits disclosure in certain legally authorized circumstances, including specified court-related situations. A subpoena and a court order are not interchangeable. A subpoena is a request or command to produce information, but it may not by itself satisfy every legal requirement for confidential mental health records.
Before releasing records in response to legal process, an organization should review the document, applicable state and federal protections, notice requirements, and any opportunity to object or seek limits. Courts may restrict disclosure, require a particular procedure, or authorize only specified records. People involved in a case may wish to seek legal advice promptly because response deadlines can be short.
Statutory disclosures and public responsibilities
Other laws may permit or require limited disclosures for specific public responsibilities, such as certain investigations, oversight, or safety-related functions. The details matter: a provision may apply only to designated recipients, defined circumstances, or a specific purpose. It should not be treated as a general exception for law enforcement, government agencies, or anyone asserting a public interest.
California law also addresses information relevant to certain involuntary evaluations and decisions. For example, WIC Section 5150.05 concerns consideration of relevant information when determining whether a person meets criteria for a 72-hour evaluation. That provision should be read alongside the applicable confidentiality rules; it does not create unrestricted access to a person’s entire treatment history.
What WIC 5328 Does Not Automatically Allow
The existence of an exception does not mean every request should be granted in full. A provider generally needs to match the request to a specific legal basis. If an exception permits disclosure for a limited purpose, releasing unrelated details could exceed that permission. Record holders should also consider whether redaction, a summary, or a narrower response can meet the lawful need.
WIC 5328 does not make every record confidential forever under every circumstance, nor does it mean every mental health document is governed by the same rule. A record may be subject to another statute, a different consent requirement, or a special limitation. The patient’s age, legal status, treatment setting, and the identity of the record holder can affect the analysis.
It is also inaccurate to assume that a clinician can disclose information whenever a safety concern arises. The applicable rules may permit specific disclosures in particular situations, but the conditions and recipients matter. Providers should follow the relevant statute and professional standards, document the reason for disclosure, and limit the information shared.
How to Request Mental Health Records in California
A person seeking records can begin by contacting the health care provider, county behavioral health department, or agency that maintains them. The request should identify the records sought and include enough information to verify the requester’s identity. If a representative is making the request, the provider may ask for documentation establishing authority.
- Identify the record holder. Records may be held by a county agency, hospital, clinic, private practitioner, or another organization.
- Submit the provider’s records request form or a written request that clearly describes the records and date range.
- Specify the delivery method and whether the request is for inspection, copies, or disclosure to a named recipient.
- Ask about limits or delays. If access is denied or narrowed, request the reason and the procedure for review or appeal.
- Keep copies of the request, authorization, response, and any supporting documents.
For a disclosure to a third party, the request should be precise. Naming the recipient and purpose, selecting a defined date range, and identifying particular records can reduce unnecessary sharing. A patient who wants a family member involved in care can discuss a limited authorization with the provider.
How Providers and Agencies Can Reduce Disclosure Risks
Organizations handling records covered by California WIC 5328 should train staff to distinguish a valid authorization from an informal request. Written policies should explain how to evaluate subpoenas, verify representatives, process patient-access requests, and respond to requests from other providers or agencies.
Practical safeguards include role-based access, secure transmission, identity verification, disclosure logs where required, and periodic review of authorization forms. Staff should document the legal basis, recipient, purpose, and scope of a disclosure. When the law is unclear or records are especially sensitive, privacy officers or legal counsel can help prevent an unauthorized release.
These safeguards protect more than compliance. Confidentiality supports trust in mental health care. People may be more willing to seek help when they understand who can see their information and when disclosure may occur. Clear explanations and careful handling of records can support both patient autonomy and effective treatment.
WIC 5328 Compared With HIPAA and Other Privacy Laws
HIPAA sets federal standards for protected health information held by covered entities and their business associates. California law may provide additional protections, and state law can control when it is more protective and not preempted by federal law. As a result, a provider may need to satisfy both HIPAA and California requirements before disclosing mental health information.
Substance use disorder records may receive heightened protection under 42 C.F.R. Part 2 when they are created or maintained by a federally assisted Part 2 program. Other laws can also govern HIV-related information, school records, minors’ care, or court-ordered treatment. The correct rule depends on the record and the setting, not just on the fact that it concerns mental health.
For official guidance, readers can consult the California Legislature’s text of WIC Section 5328, the California Department of Health Care Services, and the U.S. Department of Health and Human Services’ HIPAA Privacy Rule resources. These sources help identify current requirements, but a complex disclosure decision may require advice from a qualified attorney or privacy professional.