2005 California Civil Code Sections 56.10-56.16 CHAPTER 2. DISCLOSURE OF MEDICAL INFORMATION BY PROVIDERS ...

56.10.  (a) No provider of health care, health care service plan, or
contractor shall disclose medical information regarding a patient of
the provider of health care or an enrollee or subscriber of a health
care service plan without first obtaining an authorization, except
as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) By a coroner, when requested in the course of an investigation
by the coroner's office for the purpose of identifying the decedent
or locating next of kin, or when investigating deaths that may
involve public health concerns, organ or tissue donation, child
abuse, elder abuse, suicides, poisonings, accidents, sudden infant
death, suspicious deaths, unknown deaths, or criminal deaths, or when
otherwise authorized by the decedent's representative.  Medical
information requested by the coroner under this paragraph shall be
limited to information regarding the patient who is the decedent and
who is the subject of the investigation and shall be disclosed to the
coroner without delay upon request.
   (9) When otherwise specifically required by law.
   (c) A provider of health care or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, contractors, or other health care
professionals or facilities for purposes of diagnosis or treatment of
the patient.  This includes, in an emergency situation, the
communication of patient information by radio transmission or other
means between emergency medical personnel at the scene of an
emergency, or in an emergency medical transport vehicle, and
emergency medical personnel at a health facility licensed pursuant to
Chapter 2 (commencing with Section 1250) of Division 2 of the Health
and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, contractor, or any other person or
entity responsible for paying for health care services rendered to
the patient, to the extent necessary to allow responsibility for
payment to be determined and payment to be made.  If (A) the patient
is, by reason of a comatose or other disabling medical condition,
unable to consent to the disclosure of medical information and (B) no
other arrangements have been made to pay for the health care
services being rendered to the patient, the information may be
disclosed to a governmental authority to the extent necessary to
determine the patient's eligibility for, and to obtain, payment under
a governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2).  However, no information so disclosed shall be
further disclosed by the recipient in any way that would be violative
of this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, independent medical review organizations and
their selected reviewers, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, contractors, or persons or organizations insuring, responsible
for, or defending professional liability that a provider may incur,
if the committees, agents, health care service plans, organizations,
reviewers, contractors, or persons are engaged in reviewing the
competence or qualifications of health care professionals or in
reviewing health care services with respect to medical necessity,
level of care, quality of care, or justification of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no
patient-identifying medical information may be removed from the
premises except as expressly permitted or required elsewhere by law,
nor shall that information be further disclosed by the recipient in
any way that would violate this part.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office when requested for
all purposes not included in paragraph (8) of subdivision (b).
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a lawsuit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information, including the patient's name, city of
residence, age, sex, and general condition, may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of disease management programs and services as
defined in Section 1399.901 of the Health and Safety Code,
information may be disclosed as follows:  (A) to any entity
contracting with a health care service plan or the health care
service plan's contractors to monitor or administer care of enrollees
for a covered benefit, provided that the disease management services
and care are authorized by a treating physician, or (B) to any
disease management organization, as defined in Section 1399.900 of
the Health and Safety Code, that complies fully with the physician
authorization requirements of Section 1399.902 of the Health and
Safety Code, provided that the health care service plan or its
contractor provides or has provided a description of the disease
management services to a treating physician or to the health care
service plan's or contractor's network of physicians.  Nothing in
this paragraph shall be construed to require physician authorization
for the care or treatment of the adherents of any well-recognized
church or religious denomination who depend solely upon prayer or
spiritual means for healing in the practice of the religion of that
church or denomination.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan, contractor, or
corporation and its subsidiaries and affiliates shall intentionally
share, sell, use for marketing, or otherwise use any medical
information for any purpose not necessary to provide health care
services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor or corporation and its subsidiaries and affiliates shall
further disclose medical information regarding a patient of the
provider of health care or an enrollee or subscriber of a health care
service plan or insurer or self-insured employer received under this
section to any person or entity that is not engaged in providing
direct health care services to the patient or his or her provider of
health care or health care service plan or insurer or self-insured
employer.
56.101.  Every provider of health care, health care service plan,
pharmaceutical company, or contractor who creates, maintains,
preserves, stores, abandons, destroys, or disposes of medical records
shall do so in a manner that preserves the confidentiality of the
information contained therein.  Any provider of health care, health
care service plan, pharmaceutical company, or contractor who
negligently creates, maintains, preserves, stores, abandons,
destroys, or disposes of medical records shall be subject to the
remedies and penalties provided under subdivisions (b) and (c) of
Section 56.36.
56.102.  (a) A pharmaceutical company may not require a patient, as
a condition of receiving pharmaceuticals, medications, or
prescription drugs, to sign an authorization, release, consent, or
waiver that would permit the disclosure of medical information that
otherwise may not be disclosed under Section 56.10 or any other
provision of law, unless the disclosure is for one of the following
purposes:
   (1) Enrollment of the patient in a patient assistance program or
prescription drug discount program.
   (2) Enrollment of the patient in a clinical research project.
   (3) Prioritization of distribution to the patient of a
prescription medicine in limited supply in the United States.
   (4) Response to an inquiry from the patient communicated in
writing, by telephone, or by electronic mail.
   (b) Except as provided in subdivision (a) or Section 56.10, a
pharmaceutical company may not disclose medical information provided
to it without first obtaining a valid authorization from the patient.
56.104.  (a) Notwithstanding subdivision (c) of Section 56.10,
except as authorized in paragraph (1) of subdivision (c) of Section
56.10, no provider of health care, health care service plan, or
contractor may release medical information to persons or entities
authorized by law to receive that information pursuant to subdivision
(c) of Section 56.10, if the requested information specifically
relates to the patient's participation in outpatient treatment with a
psychotherapist, unless the person or entity requesting that
information submits to the patient pursuant to subdivision (b) and to
the provider of health care, health care service plan, or contractor
a written request, signed by the person requesting the information
or an authorized agent of the entity requesting the information, that
includes all of the following:
   (1) The specific information relating to a patient's participation
in outpatient treatment with a psychotherapist being requested and
its specific intended use or uses.
   (2) The length of time during which the information will be kept
before being destroyed or disposed of.  A person or entity may extend
that timeframe, provided that the person or entity notifies the
provider, plan, or contractor of the extension.  Any notification of
an extension shall include the specific reason for the extension, the
intended use or uses of the information during the extended time,
and the expected date of the destruction of the information.
   (3) A statement that the information will not be used for any
purpose other than its intended use.
   (4) A statement that the person or entity requesting the
information will destroy the information and all copies in the person'
s or entity's possession or control, will cause it to be destroyed,
or will return the information and all copies of it before or
immediately after the length of time specified in paragraph (2) has
expired.
   (b) The person or entity requesting the information shall submit a
copy of the written request required by this section to the patient
within 30 days of receipt of the information requested, unless the
patient has signed a written waiver in the form of a letter signed
and submitted by the patient to the provider of health care or health
care service plan waiving notification.
   (c) For purposes of this section, "psychotherapist" means a person
who is both a "psychotherapist" as defined in Section 1010 of the
Evidence Code and a "provider of health care" as defined in
subdivision (i) of Section 56.05.
   (d) This section does not apply to the disclosure or use of
medical information by a law enforcement agency or a regulatory
agency when required for an investigation of unlawful activity or for
licensing, certification, or regulatory purposes, unless the
disclosure is otherwise prohibited by law.
   (e) Nothing in this section shall be construed to grant any
additional authority to a provider of health care, health care
service plan, or contractor to disclose information to a person or
entity without the patient's consent.
56.105.  Whenever, prior to the service of a complaint upon a
defendant in any action arising out of the professional negligence of
a person holding a valid physician's and surgeon's certificate
issued pursuant to Chapter 5 (commencing with Section 2000) of
Division 2 of the Business and Professions Code, a demand for
settlement or offer to compromise is made on a patient's behalf, the
demand or offer shall be accompanied by an authorization to disclose
medical information to persons or organizations insuring, responsible
for, or defending professional liability that the certificate holder
may incur.  The authorization shall be in accordance with Section
56.11 and shall authorize disclosure of that information that is
necessary to investigate issues of liability and extent of potential
damages in evaluating the merits of the demand for settlement or
offer to compromise.
   Notice of any request for medical information made pursuant to an
authorization as provided by this section shall be given to the
patient or the patient's legal representative.  The notice shall
describe the inclusive subject matter and dates of the materials
requested and shall also authorize the patient or the patient's legal
representative to receive, upon request, copies of the information
at his or her expense.
   Nothing in this section shall be construed to waive or limit any
applicable privileges set forth in the Evidence Code except for the
disclosure of medical information subject to the patient's
authorization.  Nothing in this section shall be construed as
authorizing a representative of any person from whom settlement has
been demanded to communicate in violation of the physician-patient
privilege with a treating physician except for the medical
information request.
   The requirements of this section are independent of the
requirements of Section 364 of the Code of Civil Procedure.
56.11.  Any person or entity that wishes to obtain medical
information pursuant to subdivision (a) of Section 56.10, other than
a person or entity authorized to receive medical information pursuant
to subdivision (b) or (c) of Section 56.10, shall obtain a valid
authorization for the release of this information.
   An authorization for the release of medical information by a
provider of health care, health care service plan, pharmaceutical
company, or contractor shall be valid if it:
   (a) Is handwritten by the person who signs it or is in a typeface
no smaller than 14-point type.
   (b) Is clearly separate from any other language present on the
same page and is executed by a signature which serves no other
purpose than to execute the authorization.
   (c) Is signed and dated by one of the following:
   (1) The patient.  A patient who is a minor may only sign an
authorization for the release of medical information obtained by a
provider of health care, health care service plan, pharmaceutical
company, or contractor in the course of furnishing services to which
the minor could lawfully have consented under Part 1 (commencing with
Section 25) or Part 2.7 (commencing with Section 60).
   (2) The legal representative of the patient, if the patient is a
minor or an incompetent.  However, authorization may not be given
under this subdivision for the disclosure of medical information
obtained by the provider of health care, health care service plan,
pharmaceutical company, or contractor in the course of furnishing
services to which a minor patient could lawfully have consented under
Part 1 (commencing with Section 25) or Part 2.7 (commencing with
Section 60).
   (3) The spouse of the patient or the person financially
responsible for the patient, where the medical information is being
sought for the sole purpose of processing an application for health
insurance or for enrollment in a nonprofit hospital plan, a health
care service plan, or an employee benefit plan, and where the patient
is to be an enrolled spouse or dependent under the policy or plan.
   (4) The beneficiary or personal representative of a deceased
patient.
   (d) States the specific uses and limitations on the types of
medical information to be disclosed.
   (e) States the name or functions of the provider of health care,
health care service plan, pharmaceutical company, or contractor that
may disclose the medical information.
   (f) States the name or functions of the persons or entities
authorized to receive the medical information.
   (g) States the specific uses and limitations on the use of the
medical information by the persons or entities authorized to receive
the medical information.
   (h) States a specific date after which the provider of health
care, health care service plan, pharmaceutical company, or contractor
is no longer authorized to disclose the medical information.
   (i) Advises the person signing the authorization of the right to
receive a copy of the authorization.
56.12.  Upon demand by the patient or the person who signed an
authorization, a provider of health care, health care service plan,
pharmaceutical company, or contractor possessing the authorization
shall furnish a true copy thereof.
56.13.  A recipient of medical information pursuant to an
authorization as provided by this chapter or pursuant to the
provisions of subdivision (c) of Section 56.10 may not further
disclose that medical information except in accordance with a new
authorization that meets the requirements of Section 56.11, or as
specifically required or permitted by other provisions of this
chapter or by law.
56.14.  A provider of health care, health care service plan, or
contractor that discloses medical information pursuant to the
authorizations required by this chapter shall communicate to the
person or entity to which it discloses the medical information any
limitations in the authorization regarding the use of the medical
information.  No provider of health care, health care service plan,
or contractor that has attempted in good faith to comply with this
provision shall be liable for any unauthorized use of the medical
information by the person or entity to which the provider, plan, or
contractor disclosed the medical information.
56.15.  Nothing in this part shall be construed to prevent a person
who could  sign the authorization pursuant to subdivision (c) of
Section 56.11 from cancelling or modifying an authorization.
However, the cancellation or modification shall be effective only
after the provider of health care actually receives written notice of
the cancellation or modification.
56.16.  Unless there is a specific written request by the patient to
the contrary, nothing in this part shall be construed to prevent a
provider, upon an inquiry concerning a specific patient, from
releasing at its discretion any of the following information:  the
patient's name, address, age, and sex; a general description of the
reason for treatment (whether an injury, a burn, poisoning, or some
unrelated condition); the general nature of the injury, burn,
poisoning, or other condition; the general condition of the patient;
and any information that is not medical information as defined in
subdivision (c) of Section 56.05.