When customer records that contain personal information (including medical information) are no longer to be retained, a business shall take all reasonable steps to dispose of the records by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable or undecipherable through any means.
Every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical records shall do so in a manner that preserves the confidentiality of the information contained therein.
An agency may disclose personal information to the University of California or a nonprofit entity conducting scientific research, provided the request for information is approved by the Committee for the Protection of Human Subjects (CPHS) for the California Health and Human Services Agency (CHHSA) or an authorized institutional review board.
School districts may release information from pupil records to: (1) Appropriate persons in connection with an emergency as necessary to protect the health or safety of a pupil or other persons; (2) agencies or organizations in connection with the application of a pupil for, or receipt of, financial aid, as necessary; (3) the county elections official to identify pupils eligible to register to vote; (4) accrediting associations to carry out their accrediting functions; (5) organizations conducting studies for educational agencies or institutions, if the studies are conducted in a manner that wi
Any authorized person or entity requesting medical information relating to the patient's outpatient psychotherapy treatment must submit to the patient and to the health care provider, health care service plan, or contractor a signed written request that details: (1) the specific information being requested and its intended use; (2) the duration of its use before being destroyed or disposed of; (3) a statement that the information will not be used for any purpose other than its intended use; (4) a statement that the information and all copies of it will be destroyed or returned before or immedi
A clinical laboratory shall report all CD4+ T-Cell test results that are possibly related to an HIV infection to the local health officer within seven days of the completion of the CD4+ T-Cell test. If provided by the ordering health care provider, the lab report shall include: the patient's name, date of birth, and gender. The local health officer shall inspect each CD4+ T-Cell test report to determine if the test is related to a case of HIV infection.
