Handles health records, in California

Cal. Health and Safety Code sections 123100 to 123149.5 · Read the law's page

• If you are a health care provider the chapter covers (a licensed health facility, clinic or home health agency, or a licensed physician, podiatrist, dentist, psychologist, optometrist, chiropractor or other listed professional), permit an adult patient, a minor patient authorized to consent to treatment, or a patient's personal representative to inspect patient records during business hours within five working days after a request (section 123110(a)).
• Transmit a paper or electronic copy of the records the patient has a right to inspect within 15 days after the request, in the form and format requested if it is readily producible in that form and format (section 123110(b)).
• Charge no more than a reasonable, cost-based fee of the labor, supplies and postage the section lists, and provide a copy at no charge when it is needed to support a claim or appeal for a public benefit program as section 123110(d) describes (section 123110(d) and (j)).
• Do not withhold patient records or summaries of them because of an unpaid bill for health care services (section 123110(i)).

CCPA, Cal. Civ. Code sections 1798.146(a)(4) and 1798.148 · Read the law's page

• Do not reidentify, or attempt to reidentify, information that is deidentified under 45 CFR 164.514 and derived from patient information originally collected, created, transmitted, or maintained by an entity regulated by HIPAA, the Confidentiality of Medical Information Act or the Common Rule, except for treatment, payment or health care operations conducted by a covered entity or by a business associate at its written direction, public health activities, research under the Common Rule, a contract engaging a person to test or validate deidentification, or where otherwise required by law (Civ. Code section 1798.148(a)).
• If you engage a person to attempt reidentification to test, analyze or validate deidentification, put in the contract a ban on any other use or disclosure of the reidentified information and a requirement to return or destroy it when the work is complete (Civ. Code section 1798.148(a)(4)).
• Treat information you reidentify under an exception as subject to applicable federal and state data privacy and security laws, including HIPAA, the Confidentiality of Medical Information Act and the CCPA (Civ. Code section 1798.148(b)).
• When you sell or license deidentified patient information and a party resides or does business in California, put in the contract a statement that the information includes deidentified patient information, a statement that the purchaser or licensee may not reidentify or attempt to reidentify it, and a requirement that, unless otherwise required by law, the purchaser or licensee not disclose it further to a third party unless that party is contractually bound by the same or stricter restrictions and conditions (Civ. Code section 1798.148(c)).

Cal. Ins. Code section 791.29 · Read the law's page

• Do not require a protected individual (an adult insured, or a minor who can consent to care without a parent's or guardian's consent) to obtain the policyholder's authorization to receive sensitive services or to submit a claim for them, if that person has the right to consent to care. Recognize their right to exercise these rights exclusively as to medical information about sensitive services they received.
• Direct every communication about a protected individual's receipt of sensitive services directly to that individual: bills and collection attempts, notices of adverse benefit determinations, explanations of benefits, requests for more claim information, notices of a contested claim, the name and address of a provider with the description of services and other visit information, and any communication containing protected health information. Send them to the alternative mailing address, email address or telephone number the individual designated, or otherwise in the individual's name at the address or telephone number on file.
• Do not disclose medical information about sensitive health care services provided to a protected individual to the policyholder or any insured other than that individual without the individual's express written authorization.
• Permit an insured to request, and accommodate, confidential communication in the form and format requested if readily producible, or at alternative locations. You may require the request in writing or by electronic transmission. It covers all communications that disclose medical information or provider name and address about the requester's care until revoked or replaced. Implement it within 7 calendar days of an electronic transmission, telephone request or website request, or 14 calendar days of a first-class mail request, and acknowledge receipt and report on status if the insured contacts you.
• Notify insureds with individual or group coverage that they may request confidential communication and how, on initial enrollment and annually at renewal, in a conspicuously visible location in the evidence of coverage and on your website through a hyperlink on the home page.
• Do not condition coverage on the waiver of these rights.

Cal. Health and Safety Code Section 1367.01(k); Cal. Ins. Code Section 10123.135(j) (SB 1120, Ch. 879, Stats. 2024) · Read the law's page

• If you are a health care service plan (including a specialized plan) or a disability insurer (including a specialized health insurer) that uses an artificial intelligence, algorithm, or other software tool for utilization review or utilization management functions based in whole or in part on medical necessity, or that contracts with or otherwise works through an entity that does, ensure the tool bases its determination on the enrollee's or insured's medical or other clinical history, the individual clinical circumstances presented by the requesting provider, and other relevant clinical information in their record, and not solely on a group dataset
• Ensure the tool does not supplant health care provider decisionmaking, does not discriminate directly or indirectly against enrollees or insureds in violation of state or federal law, does not directly or indirectly cause them harm, and is fairly and equitably applied, including in accordance with applicable federal Department of Health and Human Services regulations and guidance
• Do not let the tool deny, delay, or modify health care services based, in whole or in part, on medical necessity; leave that determination to a licensed physician or a licensed health care professional competent to evaluate the specific clinical issues involved
• Keep the tool open to inspection for audit or compliance reviews, review and revise its performance, use, and outcomes periodically to maximize accuracy and reliability, and describe its use and oversight in your written utilization review policies and procedures
• Use patient data only for the tool's intended and stated purpose, consistent with the Confidentiality of Medical Information Act and the federal Health Insurance Portability and Accountability Act, as applicable
• Comply with applicable federal rules and guidance issued by the federal Department of Health and Human Services on the use of artificial intelligence, algorithm, or other software tools

Cal. Civ. Code sections 56 to 56.37 · Read the law's page

• If you are a provider of health care, a health care service plan or a contractor (a medical group, independent practice association, pharmaceutical benefits manager or medical service organization that is neither a plan nor a provider, other than an insurance institution or a pharmaceutical benefits manager licensed under the Knox-Keene Act), do not disclose a patient's, enrollee's or subscriber's medical information without first obtaining a valid authorization, unless section 56.10(b) compels the disclosure or section 56.10(c) lists the recipient or purpose.
• If your business maintains medical information so that an individual or a provider of health care can obtain it, offers software, hardware or a mobile application designed to maintain medical information for that purpose or for diagnosis, treatment or management of a medical condition, or offers a mental health digital service or a reproductive or sexual health digital service (an application or website that collects that information from a consumer, markets itself as facilitating those services and uses the information to facilitate them), treat yourself as a provider of health care under section 56.06 and keep the same standards of confidentiality for medical information disclosed to you. A cannabis business licensed under Division 10 of the Business and Professions Code that receives identification cards issued under Health and Safety Code section 11362.71, or the information in a physician's recommendation, is deemed a provider on the same terms.
• Do not intentionally share, sell, use for marketing, or otherwise use medical information for a purpose not necessary to provide health care services to the patient, unless the patient, enrollee or subscriber expressly authorizes it or section 56.10(b) or (c) provides otherwise.
• Do not disclose medical information for immigration enforcement unless the patient, enrollee or subscriber expressly authorizes it, section 56.10(b) requires it or section 56.10(c) permits it.
• Make an authorization valid under section 56.11(b): handwritten or in type no smaller than 14 points, clearly separate from other language on the page and signed with a signature that serves no other purpose, signed and dated by the patient or another person section 56.11(b)(3) lists, stating the specific uses and limits on the information, the name or function of the discloser and of each recipient, the limits on the recipient's use, and an expiration date or event (one year or less unless the signer asks for a later date or the authorization relates to an approved clinical trial or medical research study), and advising the signer of the right to receive a copy. Give the individual a copy of any signed authorization and instructions on how to get more copies or a digital version.
• If you receive medical information under an authorization or under section 56.10(c), do not disclose it further except under a new authorization that meets section 56.11 or as the part or another law specifically requires or permits.
• Create, maintain, preserve, store, abandon, destroy or dispose of medical information in a manner that preserves its confidentiality; a negligent failure to do so carries the remedies in section 56.36(b) and (c).
• Build an electronic health record or electronic medical record system so that it protects the integrity of electronic medical information and automatically records and preserves every change or deletion, including who made it, when and what changed.
• If you are a business deemed a provider under section 56.06 that electronically stores or maintains medical information on sensitive services for a provider of health care, health care service plan, pharmaceutical company, contractor or employer, have capabilities, policies and procedures (required by July 1, 2024) to limit access to information on gender affirming care, abortion and abortion-related services and contraception to authorized persons, to prevent its disclosure, access, transfer, transmission or processing to persons and entities outside California, to segregate it from the rest of the patient's record, and to disable access to it automatically by individuals and entities in another state. This duty does not apply to a contractor, health care service plan or provider of health care as section 56.05 defines them.
• Do not release medical information related to an individual seeking or obtaining an abortion in response to a subpoena or request based on another state's laws that interfere with the Reproductive Privacy Act or on a foreign penal civil action, do not release such information that would identify the individual to law enforcement to enforce those laws, and do not cooperate with an out-of-state inquiry into lawful abortion care, unless section 56.110 authorizes the request.
• If you are a health care service plan, let a protected individual receive sensitive services and submit claims for them without the policyholder's or primary subscriber's authorization, send communications about those services directly to the protected individual, accommodate subscribers' and enrollees' requests for confidential communications, implement a request within 7 calendar days of an electronic or telephone request or 14 calendar days of one by first-class mail, and tell subscribers and enrollees how to make the request on enrollment, annually on renewal, in the evidence of coverage and on your website.
• If you are a health care service plan, do not disclose the results of a test for a genetic characteristic contained in an applicant's or enrollee's medical records to a third party in a way that identifies the person without a written authorization that meets section 56.17(g), obtained for each separate disclosure.
• Do not require a patient to sign, as a condition of receiving health care services, an authorization, release, consent or waiver that would permit a disclosure the part would otherwise bar; a pharmaceutical company may not do so as a condition of receiving pharmaceuticals except for the four purposes section 56.102(a) lists.
• Release information that specifically relates to a patient's outpatient treatment with a psychotherapist to a person authorized under section 56.10(c) only on the signed written request section 56.104 describes, which also goes to the patient within 30 days of receipt of the information unless the patient has waived notice.
• On a patient's written request, provide at no charge a copy of any medical profile, summary or information you maintain about the patient if you are a business described in section 56.06 or any other entity that compiles or maintains medical information for any reason, except as section 56.07(c) provides.
• If you are an employer that receives medical information, establish appropriate procedures to ensure its confidentiality and protection from unauthorized use and disclosure, do not discriminate against an employee for refusing to sign an authorization, and do not use or disclose, or knowingly permit your employees or agents to use or disclose, medical information about your employees without an authorization that meets section 56.11 or 56.21, except as section 56.20(c) lists.
• If you furnish administrative services to programs that provide payment for health care services, do not knowingly use or disclose, or permit your employees or agents to use or disclose, medical information possessed in connection with the program except as reasonably necessary to administer or maintain it, as required by law, or with an authorization; this does not apply to a person or entity subject to the Insurance Information Privacy Act or to Chapter 2 or Chapter 3 of the part.
• If you offer a mental health digital service in partnership with a provider of health care, give the provider information on how to find data breaches reported under Civil Code section 1798.82 on the Attorney General's website.

Cal. Health and Safety Code section 1280.15 · Read the law's page

• If you are a clinic, health facility, home health agency or hospice licensed under the Health and Safety Code, prevent unlawful or unauthorized access to, and use or disclosure of, patients' medical information (section 1280.15(a)).
• Report any unlawful or unauthorized access to, or use or disclosure of, a patient's medical information to the department no later than 15 business days after you detect it (section 1280.15(b)(1)).
• Report it also to the affected patient or the patient's representative, at the last known address or the alternative location the patient specified in writing, no later than 15 business days after you detect it. Use email only if the patient previously agreed in writing (section 1280.15(b)(2)).
• Delay the report to the patient beyond 15 business days when a law enforcement agency or official states that reporting would likely impede its investigation, for the period it specifies and no longer than 60 days after a written request or 30 days after an oral request. Document an oral statement, and submit the delayed report within 15 business days after the delay ends (section 1280.15(c)).

Cal. Bus. and Prof. Code Section 22758.5; Cal. Civ. Code Sections 56.05 and 56.06 (AB 1979, Ch. 854, Stats. 2026) · Read the law's page

• Take reasonable steps to ensure that a licensed health care provider, acting within their scope of practice, keeps the ability to exercise independent professional judgment whenever a patient's care is informed by the output of a clinical decision support system
• Do not use or deploy an AI tool, system, or device to direct, guide, supervise, or instruct unlicensed personnel in a clinical function that the law requires a licensed person to perform, or to perform such a function independently
• If you offer a health care chatbot to a consumer to manage the consumer's information or for diagnosis, treatment, or management of a medical condition, handle the information as a provider of health care under the Confidentiality of Medical Information Act

Cal. Bus. and Prof. Code Sections 22758 (SB 503, Ch. 857, Stats. 2026) · Read the law's page

• Make reasonable efforts to identify any clinical decision support system you develop or deploy that is known or has a reasonably foreseeable risk of biased impacts in health programs or activities
• As a developer, make reasonable efforts to mitigate the known or reasonably foreseeable risk of biased impacts of each such system
• As a developer, make available to deployers, on request or at initial sale and on material updates, a statement of the system's intended uses and known or reasonably foreseeable risks, with documentation of training data, evaluation, data governance, intended benefits, and recommendations for use and monitoring
• As a deployer, regularly monitor each such system and take reasonable and proportionate steps to mitigate the known or reasonably foreseeable risk of biased impacts