Law / United States / California

Confidentiality of Medical Information Act

Officially Confidentiality of Medical Information Act (CMIA): disclosure, deemed providers, record security and remedies

Also known as CMIA.

Cal. Civ. Code sections 56 to 56.37

In force.

A sensitive categories rule binding public and private bodies.

Obligation class

Consent, Security, Governance, Data subject rights

Audit expectation

none

As of 21 October 2026.

What it requires

• If you are a provider of health care, a health care service plan or a contractor (a medical group, independent practice association, pharmaceutical benefits manager or medical service organization that is neither a plan nor a provider, other than an insurance institution or a pharmaceutical benefits manager licensed under the Knox-Keene Act), do not disclose a patient's, enrollee's or subscriber's medical information without first obtaining a valid authorization, unless section 56.10(b) compels the disclosure or section 56.10(c) lists the recipient or purpose.
• If your business maintains medical information so that an individual or a provider of health care can obtain it, offers software, hardware or a mobile application designed to maintain medical information for that purpose or for diagnosis, treatment or management of a medical condition, or offers a mental health digital service or a reproductive or sexual health digital service (an application or website that collects that information from a consumer, markets itself as facilitating those services and uses the information to facilitate them), treat yourself as a provider of health care under section 56.06 and keep the same standards of confidentiality for medical information disclosed to you. A cannabis business licensed under Division 10 of the Business and Professions Code that receives identification cards issued under Health and Safety Code section 11362.71, or the information in a physician's recommendation, is deemed a provider on the same terms.
• Do not intentionally share, sell, use for marketing, or otherwise use medical information for a purpose not necessary to provide health care services to the patient, unless the patient, enrollee or subscriber expressly authorizes it or section 56.10(b) or (c) provides otherwise.
• Do not disclose medical information for immigration enforcement unless the patient, enrollee or subscriber expressly authorizes it, section 56.10(b) requires it or section 56.10(c) permits it.
• Make an authorization valid under section 56.11(b): handwritten or in type no smaller than 14 points, clearly separate from other language on the page and signed with a signature that serves no other purpose, signed and dated by the patient or another person section 56.11(b)(3) lists, stating the specific uses and limits on the information, the name or function of the discloser and of each recipient, the limits on the recipient's use, and an expiration date or event (one year or less unless the signer asks for a later date or the authorization relates to an approved clinical trial or medical research study), and advising the signer of the right to receive a copy. Give the individual a copy of any signed authorization and instructions on how to get more copies or a digital version.
• If you receive medical information under an authorization or under section 56.10(c), do not disclose it further except under a new authorization that meets section 56.11 or as the part or another law specifically requires or permits.
• Create, maintain, preserve, store, abandon, destroy or dispose of medical information in a manner that preserves its confidentiality; a negligent failure to do so carries the remedies in section 56.36(b) and (c).
• Build an electronic health record or electronic medical record system so that it protects the integrity of electronic medical information and automatically records and preserves every change or deletion, including who made it, when and what changed.
• If you are a business deemed a provider under section 56.06 that electronically stores or maintains medical information on sensitive services for a provider of health care, health care service plan, pharmaceutical company, contractor or employer, have capabilities, policies and procedures (required by July 1, 2024) to limit access to information on gender affirming care, abortion and abortion-related services and contraception to authorized persons, to prevent its disclosure, access, transfer, transmission or processing to persons and entities outside California, to segregate it from the rest of the patient's record, and to disable access to it automatically by individuals and entities in another state. This duty does not apply to a contractor, health care service plan or provider of health care as section 56.05 defines them.
• Do not release medical information related to an individual seeking or obtaining an abortion in response to a subpoena or request based on another state's laws that interfere with the Reproductive Privacy Act or on a foreign penal civil action, do not release such information that would identify the individual to law enforcement to enforce those laws, and do not cooperate with an out-of-state inquiry into lawful abortion care, unless section 56.110 authorizes the request.
• If you are a health care service plan, let a protected individual receive sensitive services and submit claims for them without the policyholder's or primary subscriber's authorization, send communications about those services directly to the protected individual, accommodate subscribers' and enrollees' requests for confidential communications, implement a request within 7 calendar days of an electronic or telephone request or 14 calendar days of one by first-class mail, and tell subscribers and enrollees how to make the request on enrollment, annually on renewal, in the evidence of coverage and on your website.
• If you are a health care service plan, do not disclose the results of a test for a genetic characteristic contained in an applicant's or enrollee's medical records to a third party in a way that identifies the person without a written authorization that meets section 56.17(g), obtained for each separate disclosure.
• Do not require a patient to sign, as a condition of receiving health care services, an authorization, release, consent or waiver that would permit a disclosure the part would otherwise bar; a pharmaceutical company may not do so as a condition of receiving pharmaceuticals except for the four purposes section 56.102(a) lists.
• Release information that specifically relates to a patient's outpatient treatment with a psychotherapist to a person authorized under section 56.10(c) only on the signed written request section 56.104 describes, which also goes to the patient within 30 days of receipt of the information unless the patient has waived notice.
• On a patient's written request, provide at no charge a copy of any medical profile, summary or information you maintain about the patient if you are a business described in section 56.06 or any other entity that compiles or maintains medical information for any reason, except as section 56.07(c) provides.
• If you are an employer that receives medical information, establish appropriate procedures to ensure its confidentiality and protection from unauthorized use and disclosure, do not discriminate against an employee for refusing to sign an authorization, and do not use or disclose, or knowingly permit your employees or agents to use or disclose, medical information about your employees without an authorization that meets section 56.11 or 56.21, except as section 56.20(c) lists.
• If you furnish administrative services to programs that provide payment for health care services, do not knowingly use or disclose, or permit your employees or agents to use or disclose, medical information possessed in connection with the program except as reasonably necessary to administer or maintain it, as required by law, or with an authorization; this does not apply to a person or entity subject to the Insurance Information Privacy Act or to Chapter 2 or Chapter 3 of the part.
• If you offer a mental health digital service in partnership with a provider of health care, give the provider information on how to find data breaches reported under Civil Code section 1798.82 on the Attorney General's website.

These lines are LexLint's reading of the law's text, as of 21 October 2026.

If you get it wrong

Who enforces it

When LexLint raises it

When your app profile says your app handles health records.

Back to the example  ·  Lint your app