Understanding Privacy Protection of Medical Records In California
Personal medical information, medical records patient information are highly sensitive and confidential documents that should be safeguarded against unnecessary disclosure without the patient’s consent at all costs. The information contained in a patient’s medical records is private, and may not be disclosed without permission, save a few exceptional circumstances.
What Laws Protect Patient Medical Information?
There are a number of federal laws in place that are designed to protect the privacy of patient medical records, such as the:
- Health Insurance Portability and Accountability Act (HIPPA) Privacy Rule (45 C.F.R. Section 160, and 164A and E),
- HIPPA Security Rule (45 C.F.R. Section 160, and 164A and C), and
- HIPPA Breach Notification Rule (45 CFR Sections 164.400-414).
California additionally offers protection for patient medical records through California Civil Code Sections 56-56.37, also referred to as the Confidentiality of Medical Information Act. Under California law, a patient’s personal medical information, i.e., any individually identifiable information that is kept in physical or electronic form, is protected from unauthorized disclosure by health care providers, health care insurance providers, pharmaceutical companies, and other entities with access to this sensitive information, unless a court order demands such disclosure.
Medical information can include information concerning a patient’s medical history, mental health history, their physical or mental condition, or any course of treatment they are on. Individually identifiable information can include information such as a patient’s name, contact information, Social Security number or any other information that can be combined with publicly available information in order to identify the patient.
Patient Consent To Disclosure
Many times, a patient is referred to a specialist who requires copies of the patient’s medical records. However, the patient’s current doctor is not allowed to provide the patient’s medical records to the specialist without first obtaining the consent of the patient. If a patient wants to consent to the disclosure of their personal medical information, the patient must give permission in writing.
The requirements for providing patient consent to the sharing, releasing or disclosure of confidential medical records are outlined in California Civil Code Sections 56.11, which requires that the patient’s consent must be:
In writing and signed by the patient, the patient’s legal representative, or the beneficiary or personal representative of the patient (if the patient is deceased).
- Specific as to the permissible uses of the disclosed information, including detailing any restrictions or limitations on the disclosure of the patient’s medical records.
- Clear as to who is authorized to release/disclose the medical information concerning the patient, and must be clear as to who is the authorized recipient of the released/disclosed medical information.
- Clear as to the duration that the authorization is valid for.
Remedies For Unauthorized Disclosure
When a patient’s medical information is illegally disclosed or obtained without permission, the patient has a cause of action under California law. When the patient can show that the unauthorized disclosure amounted to some economic loss or a personal injury to the patient, then the patient has grounds for a suit. If you believe your information was disclosed without your authorization in writing and you have been damaged, contact our firm right away to speak with an experienced Los Angeles business attorney who can determine your rights and options.
We also advise businesses on how to substantially limit their liability and ensure their business policies conform to both state and federal statutes on a daily basis. Contact us if you have been accused of disclosing a patient or employee’s medical information without permission, or are unsure if your business is in full compliance with HIPPA and current employment laws.