Law / United States / 
California
Health facility medical information breach reporting
Cal. Health and Safety Code section 1280.15
In force.
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Security
As of .
What it requires
- If you are a clinic, health facility, home health agency or hospice licensed under the Health and Safety Code, prevent unlawful or unauthorized access to, and use or disclosure of, patients' medical information (section 1280.15(a)).
- Report any unlawful or unauthorized access to, or use or disclosure of, a patient's medical information to the department no later than 15 business days after you detect it (section 1280.15(b)(1)).
- Report it also to the affected patient or the patient's representative, at the last known address or the alternative location the patient specified in writing, no later than 15 business days after you detect it. Use email only if the patient previously agreed in writing (section 1280.15(b)(2)).
- Delay the report to the patient beyond 15 business days when a law enforcement agency or official states that reporting would likely impede its investigation, for the period it specifies and no longer than 60 days after a written request or 30 days after an oral request. Document an oral statement, and submit the delayed report within 15 business days after the delay ends (section 1280.15(c)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 1280.15(a): an administrative penalty of up to $25,000 per patient whose medical information was unlawfully or without authorization accessed, used or disclosed, and up to $17,500 per subsequent occurrence. Section 1280.15(d): $100 for each day a required report is late after the initial 15-day period. The total combined penalty under (a) and (d) may not exceed $250,000 per reported event.
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 250,000
- Per violation unit
- Person
- Per violation amount
- 25,000
Who enforces it
Enforcement body
The department, which assesses the administrative penalty after investigation (section 1280.15(a) and (d)).
What this law does
Health and Safety Code section 1280.15 requires a clinic, health facility, home health agency or hospice licensed under the Code to prevent unlawful or unauthorized access to, and use or disclosure of, patients' medical information.
Health and Safety Code section 1280.15 requires a licensed clinic, health facility, home health agency or hospice to report unlawful or unauthorized access to, or use or disclosure of, a patient's medical information to the department no later than 15 business days after detection.
Section 1280.15(b)(2) also requires the licensee to report it to the affected patient or the patient's representative no later than 15 business days after detection, and allows email only if the patient previously agreed in writing. Under section 1280.15(a), the department may assess an administrative penalty of up to $25,000 per patient whose medical information was unlawfully or without authorization accessed, used or disclosed, and up to $17,500 per subsequent occurrence.
Under section 1280.15(d), for a failure to report the department may assess a penalty of $100 for each day the access, use or disclosure is not reported after the initial 15-day period, and the combined penalty may not exceed $250,000 per reported event.
Section 1280.15(c)(1) requires a licensee to delay reporting to the patient when a law enforcement agency states that reporting would likely impede its investigation, for no more than 60 days after a written request or 30 days after an oral request. Section 1280.15 as currently in force was amended by Statutes 2025, chapter 21 (AB 116), effective .
When LexLint raises it
When your app profile says your app handles health records.