2010 California Code
Civil Code
Chapter 3. Use And Disclosure Of Medical Information By Employers

56.20.  (a) Each employer who receives medical information shall
establish appropriate procedures to ensure the confidentiality and
protection from unauthorized use and disclosure of that information.
These procedures may include, but are not limited to, instruction
regarding confidentiality of employees and agents handling files
containing medical information, and security systems restricting
access to files containing medical information.
   (b) No employee shall be discriminated against in terms or
conditions of employment due to that employee's refusal to sign an
authorization under this part. However, nothing in this section shall
prohibit an employer from taking such action as is necessary in the
absence of medical information due to an employee's refusal to sign
an authorization under this part.
   (c) No employer shall use, disclose, or knowingly permit its
employees or agents to use or disclose medical information which the
employer possesses pertaining to its employees without the patient
having first signed an authorization under Section 56.11 or Section
56.21 permitting such use or disclosure, except as follows:
   (1) The information may be disclosed if the disclosure is
compelled by judicial or administrative process or by any other
specific provision of law.
   (2) That part of the information which is relevant in a lawsuit,
arbitration, grievance, or other claim or challenge to which the
employer and employee are parties and in which the patient has placed
in issue his or her medical history, mental or physical condition,
or treatment may be used or disclosed in connection with that
proceeding.
   (3) The information may be used only for the purpose of
administering and maintaining employee benefit plans, including
health care plans and plans providing short-term and long-term
disability income, workers' compensation and for determining
eligibility for paid and unpaid leave from work for medical reasons.
   (4) The information may be disclosed to a provider of health care
or other health care professional or facility to aid the diagnosis or
treatment of the patient, where the patient or other person
specified in subdivision (c) of Section 56. 21 is unable to authorize
the disclosure.
   (d) If an employer agrees in writing with one or more of its
employees or maintains a written policy which provides that
particular types of medical information shall not be used or
disclosed by the employer in particular ways, the employer shall
obtain an authorization for such uses or disclosures even if an
authorization would not otherwise be required by subdivision (c).



56.21.  An authorization for an employer to disclose medical
information shall be valid if it complies with all of the following:
   (a) Is handwritten by the person who signs it or is in a typeface
no smaller than 14-point type.
   (b) Is clearly separate from any other language present on the
same page and is executed by a signature that serves no purpose other
than to execute the authorization.
   (c) Is signed and dated by one of the following:
   (1) The patient, except that a patient who is a minor may only
sign an authorization for the disclosure of medical information
obtained by a provider of health care in the course of furnishing
services to which the minor could lawfully have consented under Part
1 (commencing with Section 25) or Part 2.7 (commencing with Section
60) of Division 1.
   (2) The legal representative of the patient, if the patient is a
minor or incompetent. However, authorization may not be given under
this subdivision for the disclosure of medical information that
pertains to a competent minor and that was created by a provider of
health care in the course of furnishing services to which a minor
patient could lawfully have consented under Part 1 (commencing with
Section 25) or Part 2.7 (commencing with Section 60) of Division 1.
   (3) The beneficiary or personal representative of a deceased
patient.
   (d) States the limitations, if any, on the types of medical
information to be disclosed.
   (e) States the name or functions of the employer or person
authorized to disclose the medical information.
   (f) States the names or functions of the persons or entities
authorized to receive the medical information.
   (g) States the limitations, if any, on the use of the medical
information by the persons or entities authorized to receive the
medical information.
   (h) States a specific date after which the employer is no longer
authorized to disclose the medical information.
   (i) Advises the person who signed the authorization of the right
to receive a copy of the authorization.



56.22.  Upon demand by the patient or the person who signed an
authorization, an employer possessing the authorization shall furnish
a true copy thereof.


56.23.  An employer that discloses medical information pursuant to
an authorization required by this chapter shall communicate to the
person or entity to which it discloses the medical information any
limitations in the authorization regarding the use of the medical
information. No employer that has attempted in good faith to comply
with this provision shall be liable for any unauthorized use of the
medical information by the person or entity to which the employer
disclosed the medical information.



56.24.  Nothing in this part shall be construed to prevent a person
who could sign the authorization pursuant to subdivision (c) of
Section 56.21 from cancelling or modifying an authorization. However,
the cancellation or modification shall be effective only after the
employer actually receives written notice of the cancellation or
modification.



56.245.  A recipient of medical information pursuant to an
authorization as provided by this chapter may not further disclose
such medical information unless in accordance with a new
authorization that meets the requirements of Section 56. 21, or as
specifically required or permitted by other provisions of this
chapter or by law.