An agency that collects personal information, including electronically, must maintain the source(s) in accessible form to the data subject unless the source is the data subject or she or he has received a copy of the source document.
Agencies shall maintain records with accuracy, relevance, timeliness, and completeness to the maximum extent possible when records are used to make a determination about the individual. When records are transferred outside of state government, the agency shall update, correct, withhold, or delete any inaccurate or untimely portion of the record.
Agencies must establish rules for persons involved in the design, development, operation, disclosure, or maintenance of records containing personal information. Agencies must instruct persons involved as to the established rules and the requirements of this chapter.
Each agency shall establish appropriate and reasonable administrative, technical, and physical safeguards to ensure compliance with the IPA, to ensure the security and confidentiality of records, and to protect against anticipated threats or hazards to security.
Each agency shall retain the accounting made pursuant to Section 1798.25 for at least three years after the disclosure for which the accounting is made, or until the record is destroyed, whichever is shorter.
This section defines "personal information" which includes medical information and health insurance information. Defines "medical information" as any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional. The provision defines "health insurance information" as any unique identifier used by a health insurer to identify the individual, or any information in an individual's application and claims history, including any appeals records.
Each agency shall permit an individual to request in writing an amendment of a record and, shall within 30 days of the request, make each correction or inform the individual of its refusal to amend the record in accordance with the request.