Chapter 2 - Disclosure of Medical Information by Providers

California Civil Code — §§ 56.10-56.16

Sections (18)

Amended by Stats. 2025, Ch. 123, Sec. 2. (SB 81) Effective September 20, 2025.

(a)A provider of health care, health care service plan, or contractor shall not disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as provided in subdivision (b) or (c).

(b)A provider of health care, a health care service plan, or a contractor shall disclose medical information if the disclosure is compelled by any of the following:

(1)(A) A court order issued by a court of this

state or a federal court, including, but not limited to, a court order issued by a court of this state pursuant to Section 2029.300 of the Code of Civil Procedure relating to a foreign subpoena.

(B)A provider of health care, health care service plan, or contractor shall not comply with a court order that constitutes a foreign subpoena, absent a court order issued pursuant to Section 2029.300 of the Code of Civil Procedure.

(2)A board, commission, or administrative agency for purposes of adjudication pursuant to its lawful authority.

(3)A party to a proceeding before a court or administrative agency pursuant to a subpoena, subpoena duces tecum, notice to appear served pursuant

to Section 1987 of the Code of Civil Procedure, or any provision authorizing discovery in a proceeding before a court or administrative agency.

(4)A board, commission, or administrative agency pursuant to an investigative subpoena issued under Article 2 (commencing with Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the Government Code.

(5)An arbitrator or arbitration panel, when arbitration is lawfully requested by either party, pursuant to a subpoena duces tecum issued under Section 1282.6 of the Code of Civil Procedure, or another provision authorizing discovery in a proceeding before an arbitrator or arbitration panel.

(6)A valid search warrant issued by a judicial officer, including a

magistrate, to a governmental law enforcement agency, including a search warrant from another state that is based on either of the following and execution of the search warrant would not constitute a violation of Section 13778.2 of the Penal Code:

(A)Another state’s law, so long as that state’s law does not interfere with California law, including, but not limited to, the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).

(B)A foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.

(7)The patient or the patient’s representative pursuant to Chapter 1 (commencing with Section 123100) of Part 1 of

Division 106 of the Health and Safety Code.

(8)A medical examiner, forensic pathologist, or coroner, when requested in the course of an investigation by a medical examiner, forensic pathologist, or coroner’s office for the purpose of identifying the decedent or locating next of kin, or when investigating deaths that may involve public health concerns, organ or tissue donation, child abuse, elder abuse, suicides, poisonings, accidents, sudden infant deaths, suspicious deaths, unknown deaths, or criminal deaths, or upon notification of, or investigation of, imminent deaths that may involve organ or tissue donation pursuant to Section 7151.15 of the Health and Safety Code, or when otherwise authorized by the decedent’s representative. Medical information requested by a medical examiner, forensic pathologist, or coroner under this

paragraph shall be limited to information regarding the patient who is the decedent and who is the subject of the investigation or who is the prospective donor and shall be disclosed to a medical examiner, forensic pathologist, or coroner without delay upon request. A medical examiner, forensic pathologist, or coroner shall not disclose the information contained in the medical record obtained pursuant to this paragraph to a third party without a court order or authorization pursuant to paragraph (4) of subdivision (c) of Section 56.11.

(9)When otherwise specifically required by law.

(c)A provider of health care or a health care service plan may disclose medical information as follows:

(1)The information may be disclosed

to providers of health care, health care service plans, contractors, or other health care professionals or facilities for purposes of diagnosis or treatment of the patient. This includes, in an emergency situation, the communication of patient information by radio transmission or other means between emergency medical personnel at the scene of an emergency, or in an emergency medical transport vehicle, and emergency medical personnel at a health facility licensed pursuant to Chapter 2 (commencing with Section 1250) of Division 2 of the Health and Safety Code.

(2)The information may be disclosed to an insurer, employer, health care service plan, hospital service plan, employee benefit plan, governmental authority, contractor, or other person or entity responsible for paying for health care services rendered to the patient, to the extent

necessary to allow responsibility for payment to be determined and payment to be made. If (A) the patient is, by reason of a comatose or other disabling medical condition, unable to consent to the disclosure of medical information and (B) no other arrangements have been made to pay for the health care services being rendered to the patient, the information may be disclosed to a governmental authority to the extent necessary to determine the patient’s eligibility for, and to obtain, payment under a governmental program for health care services provided to the patient. The information may also be disclosed to another provider of health care or health care service plan as necessary to assist the other provider or health care service plan in obtaining payment for health care services rendered by that provider of health care or health care service plan to the patient.

(3)The information may be disclosed to a person or entity that provides billing, claims management, medical data processing, or other administrative services for providers of health care or health care service plans or for any of the persons or entities specified in paragraph (2). However, that disclosed information shall not be further disclosed by the recipient in a way that would violate this part.

(4)The information may be disclosed to organized committees and agents of professional societies or of medical staffs of licensed hospitals, licensed health care service plans, professional standards review organizations, independent medical review organizations and their selected reviewers, utilization and quality control peer review organizations as established by Congress in Public Law 97-248 in 1982, contractors, or persons or

organizations insuring, responsible for, or defending professional liability that a provider may incur, if the committees, agents, health care service plans, organizations, reviewers, contractors, or persons are engaged in reviewing the competence or qualifications of health care professionals or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges.

(5)The information in the possession of a provider of health care or a health care service plan may be reviewed by a private or public body responsible for licensing or accrediting the provider of health care or a health care service plan. However, no patient-identifying medical information may be removed from the premises except as expressly permitted or required elsewhere by law, nor shall that information be

further disclosed by the recipient in a way that would violate this part.

(6)The information may be disclosed to a medical examiner, forensic pathologist, or county coroner in the course of an investigation by a medical examiner, forensic pathologist, or coroner’s office when requested for all purposes not included in paragraph (8) of subdivision (b). A medical examiner, forensic pathologist, or coroner shall not disclose the information contained in the medical record obtained pursuant to this paragraph to a third party without a court order or authorization pursuant to paragraph (4) of subdivision (c) of Section 56.11.

(7)The information may be disclosed to public agencies, clinical investigators, including investigators conducting epidemiologic studies, health care research

organizations, and accredited public or private nonprofit educational or health care institutions for bona fide research purposes. However, no information so disclosed shall be further disclosed by the recipient in a way that would disclose the identity of a patient or violate this part.

(8)A provider of health care or health care service plan that has created medical information as a result of employment-related health care services to an employee conducted at the specific prior written request and expense of the employer may disclose to the employee’s employer that part of the information that:

(A)Is relevant in a lawsuit, arbitration, grievance, or other claim or challenge to which the employer and the employee are parties and in which the patient has placed in issue the patient’s

medical history, mental or physical condition, or treatment, provided that information may only be used or disclosed in connection with that proceeding.

(B)Describes functional limitations of the patient that may entitle the patient to leave from work for medical reasons or limit the patient’s fitness to perform the patient’s present employment, provided that no statement of medical cause is included in the information disclosed.

(9)Unless the provider of health care or a health care service plan is notified in writing of an agreement by the sponsor, insurer, or administrator to the contrary, the information may be disclosed to a sponsor, insurer, or administrator of a group or individual insured or uninsured plan or policy that the patient seeks coverage by or benefits

from, if the information was created by the provider of health care or health care service plan as the result of services conducted at the specific prior written request and expense of the sponsor, insurer, or administrator for the purpose of evaluating the application for coverage or benefits.

(10)The information may be disclosed to a health care service plan by providers of health care that contract with the health care service plan and may be transferred between providers of health care that contract with the health care service plan, for the purpose of administering the health care service plan. Medical information shall not otherwise be disclosed by a health care service plan except in accordance with this part.

(11)This part does not prevent the disclosure by a provider of health

care or a health care service plan to an insurance institution, agent, or support organization, subject to Article 6.6 (commencing

with Section 791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code, of medical information if the insurance institution, agent, or support organization has complied with all of the requirements for obtaining the information pursuant to Article 6.6 (commencing with Section 791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code.

(12)The information relevant to the patient’s condition, care, and treatment provided may be disclosed to a probate court investigator in the course of an investigation required or authorized in a conservatorship proceeding under the Guardianship-Conservatorship Law as defined in Section 1400 of the Probate Code, or to a probate court investigator, probation officer, or domestic relations investigator engaged in determining the need for an initial guardianship or continuation of an

existing guardianship.

(13)The information may be disclosed to an organ procurement organization or a tissue bank processing the tissue of a decedent for transplantation into the body of another person, but only with respect to the donating decedent, for the purpose of aiding the transplant. For the purpose of this paragraph, “tissue bank” and “tissue” have the same meanings as defined in Section 1635 of the Health and Safety Code.

(14)The information may be disclosed when the disclosure is otherwise specifically authorized by law, including, but not limited to, the voluntary reporting, either directly or indirectly, to the United States Food and Drug Administration of adverse events related to drug products or medical device problems, or to disclosures made pursuant to

subdivisions (b) and (c) of Section

11167 of the Penal Code by a person making a report pursuant to Sections 11165.9 and 11166 of the Penal Code, provided that those disclosures concern a report made by that person.

(15)Basic information, including the patient’s name, city of residence, age, sex, and general condition, may be disclosed to a state-recognized or federally recognized disaster relief organization for the purpose of responding to disaster welfare inquiries.

(16)The information may be disclosed to a third party for purposes of encoding, encrypting, or otherwise anonymizing data. However, no information so disclosed shall be further disclosed by the recipient in a way that would violate this part, including the unauthorized manipulation of coded or encrypted medical information that reveals

individually identifiable medical information.

(17)For purposes of disease management programs and services as defined in Section 1399.901 of the Health and Safety Code, information may be disclosed as follows:

(A)to an entity contracting with a health care service plan or the health care service plan’s contractors to monitor or administer care of enrollees for a covered benefit, if the disease management services and care are authorized by a treating physician, or (B) to a disease management organization, as defined in Section 1399.900 of the Health and Safety Code, that complies fully with the physician authorization requirements of Section 1399.902 of the Health and Safety Code, if the health care service plan or its contractor provides or has provided a description of the disease management services to a treating physician or to

the health care service plan’s or contractor’s network of physicians. This paragraph does not require physician authorization for the care or treatment of the adherents of a well-recognized church or religious denomination who depend solely upon prayer or spiritual means for healing in the practice of the religion of that church or denomination.

(18)The information may be disclosed, as permitted by state and federal law or regulation, to a local health department for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events, including, but not limited to, birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions, as authorized or required by state or federal law or regulation.

(19)The information may be disclosed, consistent with applicable law and standards of ethical conduct, by a psychotherapist, as defined in Section 1010 of the Evidence Code, if the psychotherapist, in good faith, believes the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a reasonably foreseeable victim or victims, and the disclosure is made to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat.

(20)The information may be disclosed as described in Section 56.103.

(21)(A) The information may be disclosed to an employee welfare benefit plan, as defined under Section 3(1) of the Employee Retirement

Income Security Act of 1974 (29 U.S.C. Sec. 1002(1)), which is formed under Section 302(c)(5) of the Taft-Hartley Act (29 U.S.C. Sec. 186(c)(5)), to the extent that the employee welfare benefit plan provides medical care, and may also be disclosed to an entity contracting with the employee welfare benefit plan for billing, claims management, medical data processing, or other administrative services related to the provision of medical care to persons enrolled in the employee welfare benefit plan for health care coverage, if all of the following conditions are met:

(i)The disclosure is for the purpose of determining eligibility, coordinating benefits, or allowing the employee welfare benefit plan or the contracting entity to advocate on the behalf of a patient or enrollee with a provider, a health care service plan, or a state or federal

regulatory agency.

(ii) The request for the information is accompanied by a written authorization for the release of the information submitted in a manner consistent with subdivision (a) and Section 56.11.

(iii) The disclosure is authorized by and made in a manner consistent with the federal Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191).

(iv) Any information disclosed is not further used or disclosed by the recipient in any way that would directly or indirectly violate this part or the restrictions imposed by Part 164 of Title 45 of the Code of Federal Regulations, including the manipulation of the information in any way that might reveal individually identifiable medical information.

(B) For purposes of this paragraph, Section 1374.8 of the Health and Safety Code shall not apply.

(22)Information may be disclosed pursuant to subdivision (a) of Section 15633.5 of the Welfare and Institutions Code by a person required to make a report pursuant to Section 15630 of the Welfare and Institutions Code, provided that the disclosure under subdivision (a) of Section 15633.5 concerns a report made by that person. Covered entities, as they are defined in Section 160.103 of Title 45 of the Code of Federal Regulations, shall comply with the requirements of the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy rule pursuant to subsection (c) of Section 164.512 of Title 45 of the Code of Federal Regulations if the disclosure is not for the

purpose of public health surveillance, investigation, intervention, or reporting an injury or death.

(23)The information may be disclosed to a school-linked services coordinator pursuant to a written authorization between the health provider and the patient or client that complies with the federal Health Insurance Portability and Accountability Act of 1996.

(24)Mental health records, as defined in subdivision (c) of Section 5073 of the Penal Code, may be disclosed by a county correctional facility, county medical facility, state correctional facility, or state hospital, as required by Section 5073 of the Penal Code.

(d)Except to the extent expressly authorized by a patient, enrollee, or subscriber, or as

provided by subdivisions (b) and (c), a provider of health care, health care service plan, contractor, or corporation and its subsidiaries and affiliates shall not intentionally share, sell, use for marketing, or otherwise use medical information for a purpose not necessary to provide health care services to the

patient.

(e)Except to the extent expressly authorized by a patient or enrollee or subscriber or as provided by subdivisions (b) and (c), a contractor or corporation and its subsidiaries and affiliates shall not further disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan or insurer or self-insured employer received under this section to a person or entity that is not engaged in providing direct health care services to the patient or the patient’s provider of health care or health care service plan or insurer or self-insured employer.

(f)Except to the extent expressly authorized by a patient, enrollee, or subscriber, or as required by subdivision (b), or as permitted by subdivision

(c), a provider of health care, health care service plan, contractor, or corporation and its subsidiaries and affiliates shall not disclose medical information for immigration enforcement.

(g)For purposes of this section, the following definitions apply:

(1)“Medical examiner, forensic pathologist, or coroner” means a coroner or deputy coroner, as described in subdivision (c) of Section 830.35 of the Penal Code, or a licensed physician who currently performs official autopsies on behalf of a county coroner’s office or a medical examiner’s office, whether as a government employee or under contract to that office.

(2)“School-linked services coordinator” means an individual located on a school campus or under contract by a

county behavioral health provider agency for the treatment and health care operations and referrals of students and their families that holds any of the following:

(A)A services credential with a specialization in pupil personnel services, as described in Section 44266 of the Education Code.

(B)A services credential with a specialization in health authorizing service as a school nurse, as described in Section 44877 of the Education Code.

(C)A license to engage in the practice of marriage and family therapy issued pursuant to Chapter 13 (commencing with Section 4980) of Division 2 of the Business and Professions Code.

(D)A license to engage in the practice

of educational psychology issued pursuant to Chapter 13.5 (commencing with Section 4989.10) of Division 2 of the Business and Professions Code.

(E)A license to engage in the practice of professional clinical counseling issued pursuant to Chapter 16 (commencing with Section 4999.10) of Division 2 of the Business and Professions Code.

§ 56.1007

Added by Stats. 2006, Ch. 833, Sec. 1. Effective January 1, 2007.

(a)A provider of health care, health care service plan, or contractor may, in accordance with subdivision (c) or (d), disclose to a family member, other relative, domestic partner, or a close personal friend of the patient, or any other person identified by the patient, the medical information directly relevant to that person’s involvement with the patient’s care or payment related to the patient’s health care.

(b)A provider of health care, health care service plan, or

contractor may use or disclose medical information to notify, or assist in the notification of, including identifying or locating, a family member, a personal representative of the patient, a domestic partner, or another person responsible for the care of the patient of the patient’s location, general condition, or death. Any use or disclosure of medical information for those notification purposes shall be in accordance with the provisions of subdivision (c), (d), or (e), as applicable.

(c)(1) Except as provided in paragraph (2), if the patient is present for, or otherwise available prior to, a use or disclosure permitted by subdivision (a) or (b) and has the capacity to make health care decisions, the provider of health care, health care service plan, or contractor may use or disclose the medical information if it does any of the following:

(A) Obtains the

patient’s agreement.

(B) Provides the patient with the opportunity to object to the disclosure, and the patient does not express an objection.

(C) Reasonably infers from the circumstances, based on the exercise of professional judgment, that the patient does not object to the disclosure.

(2)A provider of health care who is a psychotherapist, as defined in Section 1010 of the Evidence Code, may use or disclose medical information pursuant to this subdivision only if the psychotherapist complies with subparagraph (A) or (B) of paragraph (1).

(d)If the patient is not present, or the opportunity to agree or object to the use or disclosure cannot practicably be provided because of the patient’s incapacity or an emergency circumstance, the provider of

health care, health care service plan, or contractor may, in the exercise of professional judgment, determine whether the disclosure is in the best interests of the patient and, if so, disclose only the medical information that is directly relevant to the person’s involvement with the patient’s health care. A provider of health care, health care service plan, or contractor may use professional judgment and its experience with common practice to make reasonable inferences of the patient’s best interest in allowing a person to act on behalf of the patient to pick up filled prescriptions, medical supplies, X-rays, or other similar forms of medical information.

(e)A provider of health care, health care service plan, or contractor may use or disclose medical information to a public or private entity authorized by law or by its charter to assist in disaster relief efforts, for the purpose of coordinating with those entities the uses or disclosures

permitted by subdivision (b). The requirements in subdivisions (c) and (d) apply to those uses and disclosures to the extent that the provider of health care, health care service plan, or contractor, in the exercise of professional judgment, determines that the requirements do not interfere with the ability to respond to the emergency circumstances.

(f)Nothing in this section shall be construed to interfere with or limit the access authority of Protection and Advocacy, Inc., the Office of Patients’ Rights, or any county patients’ rights advocates to access medical information pursuant to any state or federal law.

§ 56.101

Amended by Stats. 2024, Ch. 853, Sec. 9. (AB 3281) Effective January 1, 2025.

(a)Every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall do so in a manner that preserves the confidentiality of the information contained therein. Any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall be subject to the remedies and penalties provided under subdivisions (b) and (c) of Section 56.36.

(b)(1) An electronic health record system or electronic medical record system shall do all of the following:

(A) Protect and preserve the integrity of electronic medical information.

(B) Automatically record and preserve any change or deletion of any electronically stored medical information. The record of any change or deletion shall include the identity of the person who accessed and changed the medical information, the date and time the medical information was accessed, and the change that was made to the medical information.

(2)A patient’s right to access or receive a copy of the patient’s electronic medical records upon request shall be consistent with applicable state and federal laws governing patient access to, and the use and disclosures of, medical information.

(c)(1) A business, as described in Section 56.06, that electronically

stores or maintains medical information on the provision of sensitive services, including, but not limited to, on an electronic health record system or electronic medical record system, on behalf of a provider of health care, health care service plan, pharmaceutical company, contractor, or employer, shall develop capabilities, policies, and procedures, on or before July 1, 2024, to enable all of the following:

(A) Limit user access privileges to information systems that contain medical information related to gender affirming care, abortion and abortion-related services, and contraception only to those persons who are authorized to access specified medical information.

(B) Prevent the disclosure, access, transfer, transmission, or processing of medical information related to gender affirming care, abortion and abortion-related services, and contraception to persons and entities

outside of this state in accordance to this part.

(C) Segregate medical information related to gender affirming care, abortion and abortion-related services, and contraception from the rest of the patient’s record.

(D) Provide the ability to automatically disable access to segregated medical information related to gender affirming care, abortion and abortion-related services, and contraception by individuals and entities in another state.

(2)Any fees charged to providers of health care, health care service plans, pharmaceutical company, contractors, employers, or patients to comply with this subdivision shall be consistent with Section 171.302 of Title 45 of the Code of Federal Regulations.

(3)For the purposes of this subdivision, “gender affirming

care” means gender affirming health care and gender affirming mental health care as defined in subdivision (b) of Section 16010.2 of the Welfare and Institutions Code.

(4)This subdivision does not apply to a contractor, health care service plan, or provider of health care as those terms are defined in Section 56.05.

(d)This section shall apply to an “electronic medical record” or “electronic health record” that meets the definition of “electronic health record,” as that term is defined in Section 17921(5) of Title 42 of the United States Code.

§ 56.102

Added by Stats. 2002, Ch. 853, Sec. 3. Effective January 1, 2003.

(a)A pharmaceutical company may not require a patient, as a condition of receiving pharmaceuticals, medications, or prescription drugs, to sign an authorization, release, consent, or waiver that would permit the disclosure of medical information that otherwise may not be disclosed under Section 56.10 or any other provision of law, unless the disclosure is for one of the following purposes:

(1)Enrollment of the patient in a patient assistance program or prescription drug

discount program.

(2)Enrollment of the patient in a clinical research project.

(3)Prioritization of distribution to the patient of a prescription medicine in limited supply in the United States.

(4)Response to an inquiry from the patient communicated in writing, by telephone, or by electronic mail.

(b)Except as provided in subdivision (a) or Section 56.10, a pharmaceutical company may not disclose medical information provided to it without first obtaining a valid authorization from the patient.

§ 56.103

Amended by Stats. 2015, Ch. 535, Sec. 1. (SB 319) Effective January 1, 2016.

(a)A provider of health care may disclose medical information to a county social worker, a probation officer, a foster care public health nurse acting pursuant to Section 16501.3 of the Welfare and Institutions Code, or any other person who is legally authorized to have custody or care of a minor for the purpose of coordinating health care services and medical treatment provided to the minor,

including, but not limited to, the sharing of information related to screenings, assessments, and laboratory tests necessary to monitor the administration of psychotropic medications.

(b)For purposes of this section, health care services and medical treatment includes one or more providers of health care providing, coordinating, or managing health care and related services, including, but not limited to, a provider of health care coordinating health care with a third party, consultation between providers of health care and medical treatment relating to a minor, or a provider of health care referring a minor for health care services to another provider of health care.

(c)For purposes of this section, a county social worker, a probation officer, foster care public health nurse, or any other person who is legally authorized to have custody or care of a minor shall be considered a

third party who may receive any of the following:

(1)Medical information described in Sections 56.05 and 56.10.

(2)Protected health information described in Section 160.103 of Title 45 of the Code of Federal Regulations.

(d)Medical information disclosed to a county social worker, probation officer, foster care public health nurse, or any other person who is legally authorized to have custody or care of a minor shall not be further disclosed by the recipient unless the disclosure is for the purpose of coordinating health care services and medical treatment of the minor and the disclosure is authorized by law. Medical information disclosed pursuant to this section may not be admitted into evidence in any criminal or delinquency proceeding against the minor. Nothing in this subdivision shall prohibit identical

evidence from being admissible in a criminal proceeding if that evidence is derived solely from lawful means other than this section and is permitted by law.

(e)(1) Notwithstanding Section 56.104, if a provider of health care determines that the disclosure of medical information concerning the diagnosis and treatment of a mental health condition of a minor is reasonably necessary for the purpose of assisting in coordinating the treatment and care of the minor, that information may be disclosed to a county social worker, probation officer, foster care public health nurse, or any other person who is legally authorized to have custody or care of the minor. The information shall not be further disclosed by the recipient unless the disclosure is for the purpose of coordinating mental health services and treatment of the minor and the disclosure is authorized by law.

(2)As used in this subdivision, “medical information” does not include psychotherapy notes as defined in Section 164.501 of Title 45 of the Code of Federal Regulations.

(f)The disclosure of information pursuant to this section is not intended to limit the disclosure of information when that disclosure is otherwise required by law.

(g)For purposes of this section, “minor” means a minor taken into temporary custody or as to whom a petition has been filed with the court, or who has been adjudged to be a dependent child or ward of the juvenile court pursuant to Section 300 or 601 of the Welfare and Institutions Code.

(h)(1) Except as described in paragraph (1) of subdivision (e), nothing in this section shall be construed to limit or otherwise affect existing privacy protections

provided for in state or federal law.

(2)Nothing in this section shall be construed to expand the authority of a social worker, probation officer, foster care public health nurse, or custodial caregiver beyond the authority provided under existing law to a parent or a patient representative regarding access to medical information.

§ 56.104

Amended by Stats. 2013, Ch. 444, Sec. 3. (SB 138) Effective January 1, 2014.

(a)Notwithstanding subdivision (c) of Section 56.10, except as provided in subdivision (e), no provider of health care, health care service plan, or contractor may release medical information to persons or entities who have requested that information and who are authorized by law to receive that information pursuant to subdivision (c) of Section 56.10, if the requested information specifically relates

to the patient’s participation in outpatient treatment with a psychotherapist, unless the person or entity requesting that information submits to the patient pursuant to subdivision (b) and to the provider of health care, health care service plan, or contractor a written request, signed by the person requesting the information or an authorized agent of the entity requesting the information, that includes all of the following:

(1)The specific information relating to a patient’s participation in outpatient treatment with a psychotherapist being requested and its specific intended use or uses.

(2)The length of time during which the information will be kept before being destroyed or disposed of. A person or entity may extend that timeframe, provided that the person or entity notifies the provider, plan, or contractor of the extension. Any notification of an extension shall include

the specific reason for the extension, the intended use or uses of the information during the extended time, and the expected date of the destruction of the information.

(3)A statement that the information will not be used for any purpose other than its intended use.

(4)A statement that the person or entity requesting the information will destroy the information and all copies in the person’s or entity’s possession or control, will cause it to be destroyed, or will return the information and all copies of it before or immediately after the length of time specified in paragraph (2) has expired.

(b)The person or entity requesting the information shall submit a copy of the written request required by this section to the patient within 30 days of receipt of the information requested, unless the patient has signed a

written waiver in the form of a letter signed and submitted by the patient to the provider of health care or health care service plan waiving notification.

(c)For purposes of this section, “psychotherapist” means a person who is both a “psychotherapist” as defined in Section 1010 of the Evidence Code and a “provider of health care” as defined in Section 56.05.

(d)This section does not apply to the disclosure or use of medical information by a law enforcement agency or a regulatory agency when required for an investigation of unlawful activity or for licensing, certification, or regulatory purposes, unless the disclosure is otherwise prohibited by law.

(e)This section shall not apply to any of the following:

(1)Information authorized to be disclosed

pursuant to paragraph (1) of subdivision (c) of Section 56.10.

(2)Information requested from a psychotherapist by law enforcement or by the target of the threat subsequent to a disclosure by that psychotherapist authorized by paragraph (19) of subdivision (c) of Section 56.10, in which the additional information is clearly necessary to prevent the serious and imminent threat disclosed under that paragraph.

(3)Information disclosed by a psychotherapist pursuant to paragraphs (14) and (22) of subdivision (c) of Section 56.10 and requested by an agency investigating the abuse reported pursuant to those paragraphs.

(f)Nothing in this section shall be construed to grant any additional authority to a provider of health care, health care service plan, or contractor to disclose information to a person or entity without

the patient’s consent.

§ 56.105

Amended by Stats. 2018, Ch. 389, Sec. 8. (AB 2296) Effective January 1, 2019.

Whenever, prior to the service of a complaint upon a defendant in any action arising out of the professional negligence of a person holding a valid physician’s and surgeon’s certificate issued pursuant to Chapter 5 (commencing with Section 2000) of Division 2 of the Business and Professions Code, a person holding a valid license as a marriage and family therapist issued pursuant to Chapter 13 (commencing with Section 4980) of Division 2 of

the Business and Professions Code, a person holding a valid license as a clinical social worker issued pursuant to Chapter 14 (commencing with Section 4991) of Division 2 of the Business and Professions Code, or a person holding a valid license as a professional clinical counselor issued pursuant to Chapter 16 (commencing with Section 4999.10) of Division 2 of the Business and Professions Code, a demand for settlement or offer to compromise is made on a patient’s behalf, the demand or offer shall be accompanied by an authorization to disclose medical information to persons or organizations insuring, responsible for, or defending professional liability that the certificate holder may incur. The authorization shall be in accordance with Section 56.11 and shall authorize disclosure of that information that is necessary to investigate issues of liability and extent of potential damages in evaluating the merits of the demand for settlement or offer to compromise.

Notice

of any request for medical information made pursuant to an authorization as provided by this section shall be given to the patient or the patient’s legal representative. The notice shall describe the inclusive subject matter and dates of the materials requested and shall also authorize the patient or the patient’s legal representative to receive, upon request, copies of the information at his or her expense.

Nothing in this section shall be construed to waive or limit any applicable privileges set forth in the Evidence Code except for the disclosure of medical information subject to the patient’s authorization. Nothing in this section shall be construed as authorizing a representative of any person from whom settlement has been demanded to communicate in violation of the physician-patient privilege with a treating physician, or to communicate in violation of the psychotherapist-patient privilege with a treating licensed marriage and family therapist, licensed

clinical social worker, or licensed professional clinical counselor, except for the medical information request.

The requirements of this section are independent of the requirements of Section 364 of the Code of Civil Procedure.

§ 56.106

Added by Stats. 2012, Ch. 657, Sec. 1. (SB 1407) Effective January 1, 2013.

(a)Notwithstanding Section 3025 of the Family Code, paragraph (2) of subdivision (c) of Section 56.11, or any other provision of law, a psychotherapist who knows that a minor has been removed from the custody of his or her parent or guardian pursuant to Article 6 (commencing with Section 300) to Article 10 (commencing with Section 360), inclusive, of Chapter 2 of Part 1 of Division 2 of the Welfare and Institutions Code shall not release the mental health records

of the minor patient and shall not disclose mental health information about that minor patient based upon an authorization to release those records signed by the minor’s parent or guardian. This restriction shall not apply if the juvenile court has issued an order authorizing the parent or guardian to sign an authorization for the release of the mental health records or the information about the minor patient after finding that such an order would not be detrimental to the minor patient.

(b)For purposes of this section, the following definitions apply:

(1)“Mental health records” means mental health records as defined by subdivision (b) of Section 123105 of the Health and Safety Code.

(2)“Psychotherapist” means a provider of health care as defined in Section 1010 of the Evidence Code.

(c)When the juvenile court has issued an order authorizing the parent or guardian to sign an authorization for the release of the mental health records or information about that minor patient under the circumstances described in subdivision (a), the parent or guardian seeking the release of the minor’s records or information about the minor shall present a copy of the court order to the psychotherapist before any records or information may be released pursuant to the signed authorization.

(d)Nothing in this section shall be construed to prevent or limit a psychotherapist’s authority under subdivision (a) of Section 123115 of the Health and Safety Code to deny a parent’s or guardian’s written request to inspect or obtain copies of the minor patient’s mental health records, notwithstanding the fact that the juvenile court has issued an order authorizing the parent or guardian to sign

an authorization for the release of the mental health records or information about that minor patient. Liability for a psychotherapist’s decision not to release the mental health records of the minor patient or not to disclose information about the minor patient pursuant to the authority of subdivision (a) of Section 123115 of the Health and Safety Code shall be governed by that section.

(e)Nothing in this section shall be construed to impose upon a psychotherapist a duty to inquire or investigate whether a child has been removed from the physical custody of his or her parent or guardian pursuant to Article 6 (commencing with Section 300) to Article 10 (commencing with Section 360), inclusive, of Chapter 2 of Part 1 of Division 2 of the Welfare and Institutions Code when a parent or guardian presents the minor’s psychotherapist with an authorization to release information or the mental health records regarding the minor

patient.

§ 56.107

Repealed (in Sec. 2) and added by Stats. 2021, Ch. 190, Sec. 3. (AB 1184) Effective January 1, 2022. Operative July 1, 2022, by its own provisions.

Notwithstanding any other law, and to the extent permitted by federal law, a health care service plan shall take the following steps to protect the confidentiality of a subscriber’s or enrollee’s medical information:

(a)(1) A health care service plan shall not require a protected individual to obtain the policyholder, primary subscriber, or other enrollee’s authorization to receive sensitive services or to submit a claim for sensitive services if the protected individual has the right to consent to care.

(2)A health care service plan shall recognize the right of a protected

individual to exclusively exercise rights granted under this section regarding medical information related to sensitive services that the protected individual has received.

(3)A health care service plan shall direct all communications regarding a protected individual’s receipt of sensitive services directly to the protected individual receiving care as follows:

(A)If the protected individual has designated an alternative mailing address, email address, or telephone number pursuant to subdivision (b), the health care service plan shall send or make all communications related to the protected individual’s receipt of sensitive services to the alternative mailing address, email address, or telephone number designated.

(B)If the protected individual has not designated an alternative mailing address, email address, or telephone number pursuant to subdivision (b), the health care service plan shall send or make all communications related to the protected individual’s receipt of sensitive services in the name of the protected individual at the address or telephone number on file.

(C)Communications subject to this paragraph shall include the following written, verbal, or electronic communications related to the receipt of sensitive services:

(i)Bills and attempts to collect payment.

(ii) A notice of

adverse benefits determinations.

(iii) An explanation of benefits notice.

(iv) A health care service plan’s request for additional information regarding a claim.

(v)A notice of a contested claim.

(vi) The name and address of a provider, description of services provided, and other information related to a visit.

(vii) Any written, oral, or electronic communication from a health care service plan that contains protected health information.

(4)A health care service plan shall not disclose medical information related to sensitive health care services provided to a protected individual to the policyholder, primary subscriber, or any plan enrollees other than the protected individual receiving care, absent an express written authorization of the protected individual receiving care.

(b)(1) A health care service plan shall permit subscribers and enrollees to request, and shall accommodate requests for, confidential communication in the form and format requested by the individual, if it is readily producible in the requested form and format, or at alternative locations.

(2)A health care

service plan may require the subscriber or enrollee to make a request for a confidential communication described in paragraph (1), in writing or by electronic transmission.

(3)The confidential communication request shall be valid until the subscriber or enrollee submits a revocation of the request or a new confidential communication request is submitted.

(4)The confidential communication request shall apply to all communications that disclose medical information or provider name and address related to receipt of medical services by the individual requesting the confidential communication.

(5)For the purposes of this section, a confidential communications request

shall be implemented by the health care service plan within 7 calendar days of receipt of an electronic transmission or telephonic request or within 14 calendar days of receipt by first-class mail. The health care service plan shall acknowledge receipt of the confidential communications request and advise the subscriber or enrollee of the status of implementation of the request if a subscriber or enrollee contacts the health care service plan.

(c)(1) A health care service plan shall notify subscribers and enrollees that they may request a confidential communication pursuant to subdivision (b) and how to make the request.

(2)The information required to be provided pursuant to this subdivision shall be

provided to subscribers and enrollees with individual or group coverage upon initial enrollment and annually thereafter upon renewal. The information shall also be provided in the following manner:

(A)In a conspicuously visible location in the evidence of coverage.

(B)On the health care service plan’s internet website, accessible through a hyperlink on the internet website’s home page and in a manner that allows

subscribers, enrollees, prospective subscribers, prospective enrollees, and members of the public to easily locate the information.

(d)Notwithstanding subdivision (b), the provider of health care may make arrangements with the subscriber or enrollee for the payment of benefit cost sharing and communicate that arrangement with the health care service plan.

(e)A health care service plan shall not condition enrollment or coverage on the waiver of rights provided in this section.

(f)This section shall become operative on July 1, 2022.

§ 56.108

Amended by Stats. 2023, Ch. 255, Sec. 2. (AB 352) Effective January 1, 2024.

(a)Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not release medical information related to an individual seeking or obtaining an abortion in response to a subpoena or request if that subpoena or request is based on either another state’s laws that interfere with a person’s rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code) or a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.

(b)A provider of health

care, health care service plan, contractor, or employer shall not release medical information that would identify an individual or that is related to an individual seeking or obtaining an abortion to law enforcement for either of the following purposes, unless that release is pursuant to a subpoena not otherwise prohibited by subdivision (a):

(1)Enforcement of another state’s law that would interfere with a person’s rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).

(2)Enforcement of a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.

(c)Notwithstanding subdivisions (b) and

(c)of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not cooperate with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized under Section 56.110.

(d)This section does not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.

§ 56.109

Amended by Stats. 2025, Ch. 764, Sec. 2. (SB 497) Effective October 13, 2025.

(a)Notwithstanding subdivision (b) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information related to a person seeking or obtaining gender-affirming health care or gender-affirming mental health care or a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care in response to any subpoena or request, including a foreign subpoena, based on another state’s law that interferes with an individual’s right to seek or obtain gender-affirming health care or gender-affirming mental health care or authorizes a person to bring a civil or criminal action against a person or entity that allows a child to receive gender-affirming health care or gender-affirming mental health care.

(b)Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, or contractor shall not release medical information to persons or entities who have requested that information and who are authorized by law to receive that information pursuant to subdivision (c) of Section 56.10, if the information is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care or to a person or entity allowing a child to receive gender-affirming health care or gender-affirming mental health care, and the information is being requested pursuant to another state’s law that authorizes a person to bring a civil or criminal action against a person or entity that provides, seeks, obtains, or receives gender-affirming health care or gender-affirming mental health care or who allows a child to receive gender-affirming health care or gender-affirming mental health care.

(c)Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not cooperate with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining gender-affirming health care or gender-affirming mental health care that is lawful under the laws of this state.

(d)This section does not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.

(e)This section does not prohibit compliance with an audit or investigation of

activity that is unlawful under the laws of this state or federal law, or with an audit, review, or investigation conducted for purposes of licensure, registration, accreditation, or certification under the laws of this state or federal law or pursuant to an accrediting organization recognized by the State Department of Public Health or the federal Centers for Medicare and Medicaid Services.

(f)This section does not prohibit the Department of Corrections and Rehabilitation from disclosing medical information of an individual to a health care facility that is run by an agency or department from another state, or to a federal law enforcement agency, for treatment purposes and direct medical care for the specified individual and is narrowly limited to the request.

(g)For the purposes of this section, the following terms have the following meanings:

(1)“Gender-affirming health care” and “gender-affirming mental health care” shall have the same meanings as provided in Section 16010.2 of the Welfare and Institutions Code.

(2)“Person” means an individual or governmental subdivision, agency, or instrumentality.

§ 56.110

Amended by Stats. 2025, Ch. 136, Sec. 11. (AB 260) Effective September 26, 2025.

(a)Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, pharmaceutical company, contractor, or employer shall not knowingly disclose, transmit, transfer, share, or grant access to medical information in an electronic health records system or through a health information exchange that would identify an individual and that is related to an individual seeking, obtaining, providing, supporting, or aiding in the performance of an abortion that is lawful under the laws of this state to any individual or entity from another state, unless the disclosure, transmittal, transfer, sharing, or granting of access is authorized under any of the following conditions:

(1)In accordance with a valid, written authorization

pursuant to Section 56.11 that clearly states that medical information on abortion or abortion-related services may be disclosed, and only to the extent and for the purposes expressly stated in the authorization.

(2)In accordance with paragraphs (2) and (3) of subdivision (c) of Section 56.10, to the extent necessary to allow responsibility for payment to be determined and payment to be made or to the extent that it is not further disclosed by the recipient in a way that would violate this part.

(3)In accordance with paragraphs (4) and (5) of subdivision (c) of Section 56.10 for the purpose of accreditation, in reviewing the competence or qualifications of health care professionals, or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges.

(4)In accordance with paragraph (7) of subdivision (c) of Section 56.10, for the purpose of bona fide research. Institutional Review Boards shall consider the potential harm to the patient and the patient’s privacy when the research uses data that contains information related to abortion or abortion-related services and the research is performed out of state.

(b)Notwithstanding subdivision (a), the content of the health records containing medical information described in subdivision (a) shall be disclosed to any of the following:

(1)A patient, or their personal representative, consistent with the Patient Access to Health Records Act (Chapter 1 (commencing with Section 123100) of Part 1 of Division 106 of the Health and Safety Code).

(2)In response to an order of a California or federal court, but

only to the extent clearly stated in the order and consistent with Section 1543 of the Penal Code, if applicable, and only if all information about the patient’s identity and records are protected from public scrutiny through mechanisms, including, but not limited to, a sealed proceeding or court record.

(3)When expressly required by federal law that preempts California law, but only to the extent expressly required.

(c)Nothing in this section shall prohibit a provider of health care, health care service plan, pharmaceutical company, contractor, or employer from cooperating or complying with the investigation of activity that is punishable as a crime under the laws of California, and that took place in California.

(d)A provider of health care, as defined in Section 56.05, shall not be subject to liability for

damages or to civil or enforcement actions, including disciplinary actions, fines, or penalties, for failure to meet the requirements of this section before January 31, 2027, if the provider of health care is working diligently and in good faith to come into compliance with this section.

§ 56.11

Amended by Stats. 2023, Ch. 374, Sec. 2. (AB 1697) Effective January 1, 2024.

(a)Any person or entity that wishes to obtain medical information pursuant to subdivision (a) of Section 56.10, other than a person or entity authorized to receive medical information pursuant to subdivision (b) or (c) of Section 56.10, except as provided in paragraph (21) of subdivision (c) of Section 56.10, shall obtain a valid authorization for the release of this information.

(b)An authorization for the release of medical information by a provider of health care, health care service plan, pharmaceutical company, or contractor shall be valid if it meets the following conditions:

(1)Is handwritten or is in a typeface no smaller than 14-point type.

(2)Is clearly separate from any other language present on the same page and is executed by a signature that serves no other purpose than to execute the authorization.

(3)Is signed, including with an electronic or handwritten signature, and dated by one of the following:

(A)The patient. A patient who is a minor may only sign an authorization for the release of medical information obtained by a provider of health care, health care service plan, pharmaceutical company, or contractor in the course of furnishing services to which the minor could lawfully have consented under Part 4 (commencing with Section 6900) of Division 11 of the Family Code.

(B)The legal representative of the patient, if the patient is a minor or lacks the capacity to make the decision to

authorize the release of medical information. However, authorization may not be given under this subdivision for the disclosure of medical information obtained by the provider of health care, health care service plan, pharmaceutical company, or contractor in the course of furnishing services to which a minor patient could lawfully have consented under Part 4 (commencing with Section 6900) of Division 11 of the Family Code.

(C)The spouse of the patient or the person financially responsible for the patient, where the medical information is being sought for the sole purpose of processing an application for health insurance or for enrollment in a nonprofit hospital plan, a health care service plan, or an employee benefit plan, and where the patient is to be an enrolled spouse or dependent under the policy or plan.

(D)The beneficiary, as defined in Section 24 of the Probate Code, or

personal representative, as defined in Section 58 of the Probate Code, of a deceased patient.

(4)States the specific uses and limitations on the types of medical information to be disclosed.

(5)States the name or functions of the provider of health care, health care service plan, pharmaceutical company, or contractor that may disclose the medical information.

(6)States the name or functions of the persons or entities authorized to receive the medical information.

(7)States the specific uses and limitations on the use of the medical information by the persons or entities authorized to receive the medical information.

(8)States an expiration date or event. The expiration date or event

shall limit the duration of the authorization to one year or less, unless the person signing the authorization requests a specific date beyond a year or unless the authorization is related to an approved clinical trial, as defined in Section 1370.6 of the Health and Safety Code, or medical research study, in which case the authorization may extend beyond one year if the expiration date or event extends no longer than the completion of the relevant clinical trial or research study.

(9)Advises the person signing the authorization of the right to receive a copy of the authorization.

(c)If a provider of health care, health care service plan, pharmaceutical company, contractor, or any other entity seeks an authorization from an individual for a use or disclosure of protected health information, the provider of health care, health care service plan, pharmaceutical company, contractor,

or other entity shall provide the individual with a copy of the signed authorization, and instructions on how to access additional copies or a digital version of the signed authorization.

§ 56.12

Amended by Stats. 2002, Ch. 853, Sec. 5. Effective January 1, 2003.

Upon demand by the patient or the person who signed an authorization, a provider of health care, health care service plan, pharmaceutical company, or contractor possessing the authorization shall furnish a true copy thereof.

§ 56.13

Added by Stats. 1981, Ch. 782, Sec. 2.

A recipient of medical information pursuant to an authorization as provided by this chapter or pursuant to the provisions of subdivision (c) of Section 56.10 may not further disclose that medical information except in accordance with a new authorization that meets the requirements of Section 56.11, or as specifically required or permitted by other provisions of this chapter or by law.

§ 56.14

Amended by Stats. 1999, Ch. 526, Sec. 6. Effective January 1, 2000.

A provider of health care, health care service plan, or contractor that discloses medical information pursuant to the authorizations required by this chapter shall communicate to the person or entity to which it discloses the medical information any limitations in the authorization regarding the use of the medical information. No provider of health care, health care service plan, or contractor that has attempted in good faith to comply with this provision shall be liable for any unauthorized use of the medical information by the person or entity to which the

provider, plan, or contractor disclosed the medical information.

§ 56.15

Repealed and added by Stats. 1981, Ch. 782, Sec. 2.

Nothing in this part shall be construed to prevent a person who could sign the authorization pursuant to subdivision (c) of Section 56.11 from cancelling or modifying an authorization. However, the cancellation or modification shall be effective only after the provider of health care actually receives written notice of the cancellation or modification.

§ 56.16

Amended by Stats. 2013, Ch. 444, Sec. 5. (SB 138) Effective January 1, 2014.

For disclosures not addressed by Section 56.1007, unless there is a specific written request by the patient to the contrary, nothing in this part shall be construed to prevent a general acute care hospital, as defined in subdivision (a) of Section 1250 of the Health and Safety Code, upon an inquiry concerning a specific patient, from releasing at its discretion any of the following information: the patient’s name, address,

age, and sex; a general description of the reason for treatment (whether an injury, a burn, poisoning, or some unrelated condition); the general nature of the injury, burn, poisoning, or other condition; the general condition of the patient; and any information that is not medical information as defined in Section 56.05.