2010 California Code
Civil Code
Chapter 2.5. Disclosure Of Genetic Test Results By A Health Care Service Plan

56.17.  (a) This section shall apply to the disclosure of genetic
test results contained in an applicant's or enrollee's medical
records by a health care service plan.
   (b) Any person who negligently discloses results of a test for a
genetic characteristic to any third party in a manner that identifies
or provides identifying characteristics of the person to whom the
test results apply, except pursuant to a written authorization as
described in subdivision (g), shall be assessed a civil penalty in an
amount not to exceed one thousand dollars ($1,000) plus court costs,
as determined by the court, which penalty and costs shall be paid to
the subject of the test.
   (c) Any person who willfully discloses the results of a test for a
genetic characteristic to any third party in a manner that
identifies or provides identifying characteristics of the person to
whom the test results apply, except pursuant to a written
authorization as described in subdivision (g), shall be assessed a
civil penalty in an amount not less than one thousand dollars
($1,000) and no more than five thousand dollars ($5,000) plus court
costs, as determined by the court, which penalty and costs shall be
paid to the subject of the test.
   (d) Any person who willfully or negligently discloses the results
of a test for a genetic characteristic to a third party in a manner
that identifies or provides identifying characteristics of the person
to whom the test results apply, except pursuant to a written
authorization as described in subdivision (g), that results in
economic, bodily, or emotional harm to the subject of the test, is
guilty of a misdemeanor punishable by a fine not to exceed ten
thousand dollars ($10,000).
   (e) In addition to the penalties listed in subdivisions (b) and
(c), any person who commits any act described in subdivision (b) or
(c) shall be liable to the subject for all actual damages, including
damages for economic, bodily, or emotional harm which is proximately
caused by the act.
   (f) Each disclosure made in violation of this section is a
separate and actionable offense.
   (g) The applicant's "written authorization," as used in this
section, shall satisfy the following requirements:
   (1) Is written in plain language and is in a typeface no smaller
than 14-point type.
   (2) Is dated and signed by the individual or a person authorized
to act on behalf of the individual.
   (3) Specifies the types of persons authorized to disclose
information about the individual.
   (4) Specifies the nature of the information authorized to be
disclosed.
   (5) States the name or functions of the persons or entities
authorized to receive the information.
   (6) Specifies the purposes for which the information is collected.
   (7) Specifies the length of time the authorization shall remain
valid.
   (8) Advises the person signing the authorization of the right to
receive a copy of the authorization. Written authorization is
required for each separate disclosure of the test results.
   (h) This section shall not apply to disclosures required by the
Department of Health Services necessary to monitor compliance with
Chapter 1 (commencing with Section 124975) of Part 5 of Division 106
of the Health and Safety Code, nor to disclosures required by the
Department of Managed Care necessary to administer and enforce
compliance with Section 1374.7 of the Health and Safety Code.
   (i) For purposes of this section, "genetic characteristic" has the
same meaning as that set forth in subdivision (d) of Section 1374.7
of the Health and Safety Code.