Every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical records shall do so in a manner that preserves the confidentiality of the information contained therein.
A recipient of medical information pursuant to a [valid] authorization may not further disclose that medical information except in accordance with a new authorization that meets the requirements of Section 56.11.
A provider of health care, health care service plan or contractor that discloses medical information pursuant to the authorizations required by this chapter shall communicate to the person or entity to which it discloses the medical information any limitations in the authorization regarding the use of the medical information.
An employer that receives medical information shall establish appropriate procedures such as instruction to employees and security systems to ensure the confidentiality and protection from unauthorized use and disclosure of that information.
An employer that discloses medical information pursuant to this chapter shall communicate to the person or entity to which it discloses the medical information any limitations in the authorization regarding the use of the medical information.
A recipient of medical information pursuant to a [valid] authorization may not further disclose that medical information except in accordance with a new authorization that meets the requirements of Section 56.21.
The CMIA does not apply to certain mental health and drug abuse treatment records, as enumerated in the section. These other California and federal laws control the disclosure and use of confidential medical information, and prevail over the general provisions of the CMIA.
Nothing in subdivision (f) of Section 56.30 [disclosure exemption for industrial accidents] shall permit the disclosure or use of medical information regarding whether a patient is infected with or exposed to HIV without the prior authorization from the patient, unless the patient is an injured worker claiming to be infected with or exposed to HIV through a work-related exposure incident.
Any authorized person or entity requesting medical information relating to the patient's outpatient psychotherapy treatment must submit to the patient and to the health care provider, health care service plan, or contractor a signed written request that details: (1) the specific information being requested and its intended use; (2) the duration of its use before being destroyed or disposed of; (3) a statement that the information will not be used for any purpose other than its intended use; (4) a statement that the information and all copies of it will be destroyed or returned before or immedi
