|
|
|
information shall do so in a manner that preserves the
confidentiality of the information contained therein. Any
provider of health care, health care service plan, pharmaceutical
company, or contractor who negligently creates, maintains,
preserves, stores, abandons, destroys, or disposes of medical
information shall be subject to the remedies and penalties
provided under subdivisions (b) and (c) of Section 56.36.
(b) (1) An electronic health record system or electronic medical
record system shall do the following:
(A) Protect and preserve the integrity of electronic medical
information.
(B) Automatically record and preserve any change or deletion of
any electronically stored medical information. The record of any
change or deletion shall include the identity of the person who
accessed and changed the medical information, the date and
time the medical information was accessed, and the change that
was made to the medical information.
(2) A patient’s right to access or receive a copy of his or her
electronic medical records upon request shall be consistent with
applicable state and federal laws governing patient access to, and
the use and disclosures of, medical information.
(c) This section shall apply to an “electronic medical record” or
“electronic health record” that meets the definition of
“electronic health record,” as that term is defined in Section
17921(5) of Title 42 of the United States Code.
56.102. Disclosure of Medical Information to Pharmaceutical
Company not Required; Exceptions
(a) A pharmaceutical company may not require a patient, as a
condition of receiving pharmaceuticals, medications, or
prescription drugs, to sign an authorization, release, consent, or
waiver that would permit the disclosure of medical information
that otherwise may not be disclosed under Section 56.10 or any
other provision of law, unless the disclosure is for one of the
following purposes:
760
(1) Enrollment of the patient in a patient assistance program or
prescription drug discount program.
(2) Enrollment of the patient in a clinical research project.
(3) Prioritization of distribution to the patient of a prescription
medicine in limited supply in the United States.
(4) Response to an inquiry from the patient communicated in
writing, by telephone, or by electronic mail.
(b) Except as provided in subdivision (a) or Section 56.10, a
pharmaceutical company may not disclose medical information
provided to it without first obtaining a valid authorization from
the patient.
56.104. Standards for Disclosing Information Related to
Outpatient Psychotherapy
(a) Notwithstanding subdivision (c) of Section 56.10, except as
provided in subdivision (e), no provider of health care, health
care service plan, or contractor may release medical information
to persons or entities who have requested that information and
who are authorized by law to receive that information pursuant
to subdivision (c) of Section 56.10, if the requested information
specifically relates to the patient’s participation in outpatient
treatment with a psychotherapist, unless the person or entity
requesting that information submits to the patient pursuant to
subdivision (b) and to the provider of health care, health care
service plan, or contractor a written request, signed by the
person requesting the information or an authorized agent of the
entity requesting the information, that includes all of the
following:
(1) The specific information relating to a patient’s participation
in outpatient treatment with a psychotherapist being requested
and its specific intended use or uses.
(2) The length of time during which the information will be kept
before being destroyed or disposed of. A person or entity may
extend that timeframe, provided that the person or entity
notifies the provider, plan, or contractor of the extension. Any
761
notification of an extension shall include the specific reason for
the extension, the intended use or uses of the information during
the extended time, and the expected date of the destruction of
the information.
(3) A statement that the information will not be used for any
purpose other than its intended use.
(4) A statement that the person or entity requesting the
information will destroy the information and all copies in the
person’s or entity’s possession or control, will cause it to be
destroyed, or will return the information and all copies of it
before or immediately after the length of time specified in
paragraph (2) has expired.
(b) The person or entity requesting the information shall submit
a copy of the written request required by this section to the
patient within 30 days of receipt of the information requested,
unless the patient has signed a written waiver in the form of a
letter signed and submitted by the patient to the provider of
health care or health care service plan waiving notification.
(c) For purposes of this section, “psychotherapist” means a
person who is both a “psychotherapist” as defined in Section
1010 of the Evidence Code and a “provider of health care” as
defined in Section 56.05.
(d) This section does not apply to the disclosure or use of
medical information by a law enforcement agency or a regulatory
agency when required for an investigation of unlawful activity or
for licensing, certification, or regulatory purposes, unless the
disclosure is otherwise prohibited by law.
(e) This section shall not apply to any of the following:
(1) Information authorized to be disclosed pursuant to
paragraph (1) of subdivision (c) of Section 56.10.
(2) Information requested from a psychotherapist by law
enforcement or by the target of the threat subsequent to a
disclosure by that psychotherapist authorized by paragraph (19)
of subdivision (c) of Section 56.10, in which the additional
762
information is clearly necessary to prevent the serious and
imminent threat disclosed under that paragraph.
(3) Information disclosed by a psychotherapist pursuant to
paragraphs (14) and (22) of subdivision (c) of Section 56.10 and
requested by an agency investigating the abuse reported
pursuant to those paragraphs.
(f) Nothing in this section shall be construed to grant any
additional authority to a provider of health care, health care
service plan, or contractor to disclose information to a person or
entity without the patient’s consent.
56.105. Disclosure of Records for Malpractice Suits
Whenever, prior to the service of a complaint upon a defendant
in any action arising out of the professional negligence of a
person holding a valid physician’s and surgeon’s certificate issued
pursuant to Chapter 5 (commencing with Section 2000) of
Division 2 of the Business and Professions Code, a person holding
a valid license as a marriage and family therapist issued pursuant
to Chapter 13 (commencing with Section 4980) of Division 2 of
the Business and Professions Code, a person holding a valid
license as a clinical social worker issued pursuant to Chapter 14
(commencing with Section 4991) of Division 2 of the Business and
Professions Code, or a person holding a valid license as a
professional clinical counselor issued pursuant to Chapter 16
(commencing with Section 4999.10) of Division 2 of the Business
and Professions Code, a demand for settlement or offer to
compromise is made on a patient’s behalf, the demand or offer
shall be accompanied by an authorization to disclose medical
information to persons or organizations insuring, responsible for,
or defending professional liability that the certificate holder may
incur. The authorization shall be in accordance with Section 56.11
and shall authorize disclosure of that information that is
necessary to investigate issues of liability and extent of potential
damages in evaluating the merits of the demand for settlement
or offer to compromise.
763
Notice of any request for medical information made pursuant to
an authorization as provided by this section shall be given to the
patient or the patient’s legal representative. The notice shall
describe the inclusive subject matter and dates of the materials
requested and shall also authorize the patient or the patient’s
legal representative to receive, upon request, copies of the
information at his or her expense.
Nothing in this section shall be construed to waive or limit any
applicable privileges set forth in the Evidence Code except for the
disclosure of medical information subject to the patient’s
authorization. Nothing in this section shall be construed as
authorizing a representative of any person from whom
settlement has been demanded to communicate in violation of
the physician-patient privilege with a treating physician, or to
communicate in violation of the psychotherapist-patient privilege
with a treating licensed marriage and family therapist, licensed
clinical social worker, or licensed professional clinical counselor,
except for the medical information request.
The requirements of this section are independent of the
requirements of Section 364 of the Code of Civil Procedure.
56.11. Standards for Authorizing Medical Information
Disclosure
Any person or entity that wishes to obtain medical information
pursuant to subdivision (a) of Section 56.10, other than a person
or entity authorized to receive medical information pursuant to
subdivision (b) or (c) of Section 56.10, except as provided in
paragraph (21) of subdivision (c) of Section 56.10, shall obtain a
valid authorization for the release of this information.
An authorization for the release of medical information by a
provider of health care, health care service plan, pharmaceutical
company, or contractor shall be valid if it:
(a) Is handwritten by the person who signs it or is in a typeface
no smaller than 14-point type.
764
(b) Is clearly separate from any other language present on the
same page and is executed by a signature which serves no other
purpose than to execute the authorization.
(c) Is signed and dated by one of the following:
(1) The patient. A patient who is a minor may only sign an
authorization for the release of medical information obtained by
a provider of health care, health care service plan,
pharmaceutical company, or contractor in the course of
furnishing services to which the minor could lawfully have
consented under Part 1 (commencing with Section 25) or Part 2.7
(commencing with Section 60).
(2) The legal representative of the patient, if the patient is a
minor or an incompetent. However, authorization may not be
given under this subdivision for the disclosure of medical
information obtained by the provider of health care, health care
service plan, pharmaceutical company, or contractor in the
course of furnishing services to which a minor patient could
lawfully have consented under Part 1 (commencing with Section
25) or Part 2.7 (commencing with Section 60).
(3) The spouse of the patient or the person financially
responsible for the patient, where the medical information is
being sought for the sole purpose of processing an application for
health insurance or for enrollment in a nonprofit hospital plan, a
health care service plan, or an employee benefit plan, and where
the patient is to be an enrolled spouse or dependent under the
policy or plan.
(4) The beneficiary or personal representative of a deceased
patient.
(d) States the specific uses and limitations on the types of
medical information to be disclosed.
(e) States the name or functions of the provider of health care,
health care service plan, pharmaceutical company, or contractor
that may disclose the medical information.
(f) States the name or functions of the persons or entities
authorized to receive the medical information.
765
(g) States the specific uses and limitations on the use of the
medical information by the persons or entities authorized to
receive the medical information.
(h) States a specific date after which the provider of health care,
health care service plan, pharmaceutical company, or contractor
is no longer authorized to disclose the medical information.
(i) Advises the person signing the authorization of the right to
receive a copy of the authorization.
56.12. Requirement to Furnish Information
Upon demand by the patient or the person who signed an
authorization, a provider of health care, health care service plan,
pharmaceutical company, or contractor possessing the
authorization shall furnish a true copy thereof.
56.13. Prohibition of Further Disclosure
A recipient of medical information pursuant to an authorization
as provided by this chapter or pursuant to the provisions of
subdivision (c) of Section 56.10 may not further disclose that
medical information except in accordance with a new
authorization that meets the requirements of Section 56.11, or as
specifically required or permitted by other provisions of this
chapter or by law.
56.14. Limitations on Use of Disclosed Information
A provider of health care, health care service plan, or contractor
that discloses medical information pursuant to the authorizations
required by this chapter shall communicate to the person or
entity to which it discloses the medical information any
limitations in the authorization regarding the use of the medical
information. No provider of health care, health care service plan,
or contractor that has attempted in good faith to comply with
this provision shall be liable for any unauthorized use of the
medical information by the person or entity to which the
provider, plan, or contractor disclosed the medical information.
766
56.15. Patient’s Right to Cancel or Modify Disclosure
Authorization
Nothing in this part shall be construed to prevent a person who
could sign the authorization pursuant to subdivision (c) of Section
56.11 from cancelling or modifying an authorization. However,
the cancellation or modification shall be effective only after the
provider of health care actually receives written notice of the
cancellation or modification.
56.16. Information Providers May Disclose Without
Authorization
For disclosures not addressed by Section 56.1007, unless there
is a specific written request by the patient to the contrary,
nothing in this part shall be construed to prevent a general acute
care hospital, as defined in subdivision (a) of Section 1250 of the
Health and Safety Code, upon an inquiry concerning a specific
patient, from releasing at its discretion any of the following
information: the patient’s name, address, age, and sex; a general
description of the reason for treatment (whether an injury, a
burn, poisoning, or some unrelated condition); the general
nature of the injury, burn, poisoning, or other condition; the
general condition of the patient; and any information that is not
medical information as defined in Section 56.05.
CHAPTER 6. RELATIONSHIP TO EXISTING LAW
56.30. Exceptions to the Act
The disclosure and use of the following medical information
shall not be subject to the limitations of this part:
(a) (Mental health and developmental disabilities) Information
and records obtained in the course of providing services under
Division 4 (commencing with Section 4000), Division 4.1
(commencing with Section 4400), Division 4.5 (commencing with
Section 4500), Division 5 (commencing with Section 5000),
Division 6 (commencing with Section 6000), or Division 7
767
(commencing with Section 7100) of the Welfare and Institutions
Code.
(b) (Public social services) Information and records that are
subject to Sections 10850, 14124.1, and 14124.2 of the Welfare
and Institutions Code.
(c) (State health services, communicable diseases,
developmental disabilities) Information and records maintained
pursuant to former Chapter 2 (commencing with Section 200) of
Part 1 of Division 1 of the Health and Safety Code and pursuant
to the Communicable Disease Prevention and Control Act
(subdivision (a) of Section 27 of the Health and Safety Code).
(d) (Licensing and statistics) Information and records maintained
pursuant to Division 2 (commencing with Section 1200) and Part
1 (commencing with Section 102100) of Division 102 of the
Health and Safety Code; pursuant to Chapter 3 (commencing
with Section 1200) of Division 2 of the Business and Professions
Code; and pursuant to Section 8608, 8817, or 8909 of the Family
Code.
(e) (Medical survey, workers’ safety) Information and records
acquired and maintained or disclosed pursuant to Sections 1380
and 1382 of the Health and Safety Code and pursuant to Division
5 (commencing with Section 6300) of the Labor Code.
(f) (Industrial accidents) Information and records acquired,
maintained, or disclosed pursuant to Division 1 (commencing
with Section 50), Division 4 (commencing with Section 3200),
Division 4.5 (commencing with Section 6100), and Division 4.7
(commencing with Section 6200) of the Labor Code.
(g) (Law enforcement) Information and records maintained by a
health facility which are sought by a law enforcement agency
under Chapter 3.5 (commencing with Section 1543) of Title 12 of
Part 2 of the Penal Code.
(h) (Investigations of employment accident or illness)
Information and records sought as part of an investigation of an
on-the-job accident or illness pursuant to Division 5 (commencing
768
with Section 6300) of the Labor Code or pursuant to Section
105200 of the Health and Safety Code.
(i) (Alcohol or drug abuse) Information and records subject to
the federal alcohol and drug abuse regulations (Part 2
(commencing with Section 2.1) of Subchapter A of Chapter 1 of
Title 42 of the Code of Federal Regulations) or to Section 11845.5
of the Health and Safety Code dealing with alcohol and drug
abuse.
(j) (Patient discharge data) Nothing in this part shall be
construed to limit, expand, or otherwise affect the authority of
the California Health Facilities Commission to collect patient
discharge information from health facilities.
(k) Medical information and records disclosed to, and their use
by, the Insurance Commissioner, the Director of the Department
of Managed Health Care, the Division of Industrial Accidents, the
Workers’ Compensation Appeals Board, the Department of
Insurance, or the Department of Managed Health Care.
(l) Medical information and records related to services provided
on and after January 1, 2006, disclosed to, and their use by, the
Managed Risk Medical Insurance Board to the same extent that
those records are required to be provided to the board related to
services provided on and after July 1, 2009, to comply with
Section 403 of the federal Children’s Health Insurance Program
Reauthorization Act of 2009 (Public Law 111-3), applying
subdivision (c) of Section 1932 of the federal Social Security Act.
56.31. Disclosure of Patient Information Related to HIV
Prohibited without Authorization
Notwithstanding any other provision of law, nothing in
subdivision (f) of Section 56.30 shall permit the disclosure or use
of medical information regarding whether a patient is infected
with or exposed to the human immunodeficiency virus without
the prior authorization from the patient unless the patient is an
injured worker claiming to be infected with or exposed to the
769
human immunodeficiency virus through an exposure incident
arising out of and in the course of employment.
CHAPTER 7. VIOLATIONS
56.35. Limitation on Damage Awards and Attorney Fee Awards
In addition to any other remedies available at law, a patient
whose medical information has been used or disclosed in
violation of Section 56.10 or 56.104 or 56.20 or subdivision (a) of
Section 56.26 and who has sustained economic loss or personal
injury therefrom may recover compensatory damages, punitive
damages not to exceed three thousand dollars ($3,000),
attorneys' fees not to exceed one thousand dollars ($1,000), and
the costs of litigation.
56.36. Penalties
(a) A violation of the provisions of this part that results in
economic loss or personal injury to a patient is punishable as a
misdemeanor.
(b) In addition to any other remedies available at law, an
individual may bring an action against a person or entity who has
negligently released confidential information or records
concerning him or her in violation of this part, for either or both
of the following:
(1) Except as provided in subdivision (e), nominal damages of
one thousand dollars ($1,000). In order to recover under this
paragraph, it is not necessary that the plaintiff suffered or was
threatened with actual damages.
(2) The amount of actual damages, if any, sustained by the
patient.
(c) (1) In addition, a person or entity that negligently discloses
medical information in violation of the provisions of this part
shall also be liable, irrespective of the amount of damages
suffered by the patient as a result of that violation, for an
770
administrative fine or civil penalty not to exceed two thousand
five hundred dollars ($2,500) per violation.
(2) (A) A person or entity, other than a licensed health care
professional, who knowingly and willfully obtains, discloses, or
uses medical information in violation of this part shall be liable
for an administrative fine or civil penalty not to exceed twenty-
five thousand dollars ($25,000) per violation.
(B) A licensed health care professional who knowingly and
willfully obtains, discloses, or uses medical information in
violation of this part shall be liable on a first violation for an
administrative fine or civil penalty not to exceed two thousand
five hundred dollars ($2,500) per violation, on a second violation
for an administrative fine or civil penalty not to exceed ten
thousand dollars ($10,000) per violation, or on a third and
subsequent violation for an administrative fine or civil penalty
not to exceed twenty-five thousand dollars ($25,000) per
violation. This subdivision shall not be construed to limit the
liability of a health care service plan, a contractor, or a provider
of health care that is not a licensed health care professional for a
violation of this part.
(3) (A) A person or entity, other than a licensed health care
professional, who knowingly or willfully obtains or uses medical
information in violation of this part for the purpose of financial
gain shall be liable for an administrative fine or civil penalty not
to exceed two hundred fifty thousand dollars ($250,000) per
violation and shall also be subject to disgorgement of any
proceeds or other consideration obtained as a result of the
violation.
(B) A licensed health care professional who knowingly and
willfully obtains, discloses, or uses medical information in
violation of this part for financial gain shall be liable on a first
violation for an administrative fine or civil penalty not to exceed
five thousand dollars ($5,000) per violation, on a second violation
for an administrative fine or civil penalty not to exceed twenty-
five thousand dollars ($25,000) per violation, or on a third and
771
subsequent violation for an administrative fine or civil penalty
not to exceed two hundred fifty thousand dollars ($250,000) per
violation and shall also be subject to disgorgement of any
proceeds or other consideration obtained as a result of the
violation. This subdivision shall not be construed to limit the
liability of a health care service plan, a contractor, or a provider
of health care that is not a licensed health care professional for
any violation of this part.
(4) This subdivision shall not be construed as authorizing an
administrative fine or civil penalty under both paragraphs (2) and
(3) for the same violation.
(5) A person or entity who is not permitted to receive medical
information pursuant to this part and who knowingly and willfully
obtains, discloses, or uses medical information without written
authorization from the patient shall be liable for a civil penalty
not to exceed two hundred fifty thousand dollars ($250,000) per
violation.
(d) In assessing the amount of an administrative fine or civil
penalty pursuant to subdivision (c), the State Department of
Public Health, licensing agency, or certifying board or court shall
consider any of the relevant circumstances presented by any of
the parties to the case including, but not limited to, the
following:
(1) Whether the defendant has made a reasonable, good faith
attempt to comply with this part.
(2) The nature and seriousness of the misconduct.
(3) The harm to the patient, enrollee, or subscriber.
(4) The number of violations.
(5) The persistence of the misconduct.
(6) The length of time over which the misconduct occurred.
(7) The willfulness of the defendant’s misconduct.
(8) The defendant’s assets, liabilities, and net worth.
(e) (1) In an action brought by an individual pursuant to
subdivision (b) on or after January 1, 2013, in which the
defendant establishes the affirmative defense in paragraph (2),
772
the court shall award any actual damages and reasonable
attorney’s fees and costs, but shall not award nominal damages
for a violation of this part.
(2) The defendant is entitled to an affirmative defense if all of
the following are established, subject to the equitable
considerations in paragraph (3):
(A) The defendant is a covered entity or business associate, as
defined in Section 160.103 of Title 45 of the Code of Federal
Regulations, in effect as of January 1, 2012.
(B) The defendant has complied with any obligations to notify all
persons entitled to receive notice regarding the release of the
information or records.
(C) The release of confidential information or records was solely
to another covered entity or business associate.
(D) The release of confidential information or records was not
an incident of medical identity theft. For purposes of this
subparagraph, “medical identity theft” means the use of an
individual’s personal information, as defined in Section 1798.80,
without the individual’s knowledge or consent, to obtain medical
goods or services, or to submit false claims for medical services.
(E) The defendant took appropriate preventive actions to
protect the confidential information or records against release
consistent with the defendant’s obligations under this part or
other applicable state law and the Health Insurance Portability
and Accountability Act of 1996 (Public Law 104-191) (HIPAA) and
all HIPAA Administrative Simplification Regulations in effect on
January 1, 2012, contained in Parts 160, 162, and 164 of Title 45
of the Code of Federal Regulations, and Part 2 of Title 42 of the
Code of Federal Regulations, including, but not limited to, all of
the following:
(i) Developing and implementing security policies and
procedures.
(ii) Designating a security official who is responsible for
developing and implementing its security policies and
procedures, including educating and training the workforce.
773
(iii) Encrypting the information or records, and protecting
against the release or use of the encryption key and passwords,
or transmitting the information or records in a manner designed
to provide equal or greater protections against improper
disclosures.
(F) The defendant took reasonable and appropriate corrective
action after the release of the confidential information or
records, and the covered entity or business associate that
received the confidential information or records destroyed or
returned the confidential information or records in the most
expedient time possible and without unreasonable delay,
consistent with any measures necessary to determine the scope
of the breach and restore the reasonable integrity of the data
system. A court may consider this subparagraph to be
established if the defendant shows in detail that the covered
entity or business associate could not destroy or return the
confidential information or records because of the technology
utilized.
(G) The covered entity or business associate that received the
confidential information or records, or any of its agents,
independent contractors, or employees, regardless of the scope
of the employee’s employment, did not retain, use, or release
the information or records.
(H) After the release of the confidential information or records,
the defendant took reasonable and appropriate action to prevent
a future similar release of confidential information or records.
(I) The defendant has not previously established an affirmative
defense pursuant to this subdivision, or the court determines, in
its discretion, that application of the affirmative defense is
compelling and consistent with the purposes of this section to
promote reasonable conduct in light of all the facts.
(3) (A) In determining whether the affirmative defense may be
established pursuant to paragraph (2), the court shall consider
the equity of the situation, including, but not limited to, (i)
whether the defendant has previously violated this part,
774
regardless of whether an action has previously been brought, and
(ii) the nature of the prior violation.
(B) To the extent the court allows discovery to determine
whether there has been any other violation of this part that the
court will consider in balancing the equities, the defendant shall
not provide any medical information, as defined in Section 56.05.
The court, in its discretion, may enter a protective order
prohibiting the further use of any personal information, as
defined in Section 1798.80, about the individual whose medical
information may have been disclosed in a prior violation.
(4) In an action under this subdivision in which the defendant
establishes the affirmative defense pursuant to paragraph (2), a
plaintiff shall be entitled to recover reasonable attorney’s fees
and costs without regard to an award of actual or nominal
damages or the imposition of administrative fines or civil
penalties.
(5) In an action brought by an individual pursuant to subdivision
(b) on or after January 1, 2013, in which the defendant
establishes the affirmative defense pursuant to paragraph (2), a
defendant shall not be liable for more than one judgment on the
merits under this subdivision for releases of confidential
information or records arising out of the same event, transaction,
or occurrence.
(f) (1) The civil penalty pursuant to subdivision (c) shall be
assessed and recovered in a civil action brought in the name of
the people of the State of California in any court of competent
jurisdiction by any of the following:
(A) The Attorney General.
(B) A district attorney.
(C) A county counsel authorized by agreement with the district
attorney in actions involving violation of a county ordinance.
(D) A city attorney of a city.
(E) A city attorney of a city and county having a population in
excess of 750,000, with the consent of the district attorney.
775
(F) A city prosecutor in a city having a full-time city prosecutor
or, with the consent of the district attorney, by a city attorney in
a city and county.
(G) The State Public Health Officer, or his or her designee, may
recommend that a person described in subparagraphs (A) to (F),
inclusive, bring a civil action under this section.
(2) If the action is brought by the Attorney General, one-half of
the penalty collected shall be paid to the treasurer of the county
in which the judgment was entered, and one-half to the General
Fund. If the action is brought by a district attorney or county
counsel, the penalty collected shall be paid to the treasurer of
the county in which the judgment was entered. Except as
provided in paragraph (3), if the action is brought by a city
attorney or city prosecutor, one-half of the penalty collected
shall be paid to the treasurer of the city in which the judgment
was entered and one-half to the treasurer of the county in which
the judgment was entered.
(3) If the action is brought by a city attorney of a city and
county, the entire amount of the penalty collected shall be paid
to the treasurer of the city and county in which the judgment was
entered.
(4) This section shall not be construed as authorizing both an
administrative fine and civil penalty for the same violation.
(5) Imposition of a fine or penalty provided for in this section
shall not preclude imposition of other sanctions or remedies
authorized by law.
(6) Administrative fines or penalties issued pursuant to Section
1280.15 of the Health and Safety Code shall offset any other
administrative fine or civil penalty imposed under this section for
the same violation.
(g) For purposes of this section, “knowing” and “willful” shall
have the same meanings as in Section 7 of the Penal Code.
(h) A person who discloses protected medical information in
accordance with the provisions of this part is not subject to the
penalty provisions of this part.
776
56.37. Requiring Patient to Authorize Disclosure of Information
as Condition for Service is Prohibited
(a) No provider of health care, health care service plan, or
contractor may require a patient, as a condition of receiving
health care services, to sign an authorization, release, consent, or
waiver that would permit the disclosure of medical information
that otherwise may not be disclosed under Section 56.10 or any
other provision of law. However, a health care service plan or
disability insurer may require relevant enrollee or subscriber
medical information as a condition of the medical underwriting
process, provided that Sections 1374.7 and 1389.1 of the Health
and Safety Code are strictly observed.
(b) Any waiver by a patient of the provisions of this part, except
as authorized by Section 56.11 or 56.21 or subdivision (b) of
Section 56.26, shall be deemed contrary to public policy and shall
be unenforceable.
Civil Code
Division 3, Part 4
PART 4. OBLIGATIONS ARISING FROM PARTICULAR
TRANSACTIONS
Section
1798.29.
Security Breach Notification
1798.82.
Security Breach Notification
Title 1.8. Personal Data
1798.29. Computerized Data; Security Breach Notification
Requirements
(a) Any agency that owns or licenses computerized data that
includes personal information shall disclose any breach of the
security of the system following discovery or notification of the
777
breach in the security of the data to any resident of California
whose unencrypted personal information was, or is reasonably
believed to have been, acquired by an unauthorized person. The
disclosure shall be made in the most expedient time possible and
without unreasonable delay, consistent with the legitimate needs
of law enforcement, as provided in subdivision (c), or any
measures necessary to determine the scope of the breach and
restore the reasonable integrity of the data system.
(b) Any agency that maintains computerized data that includes
personal information that the agency does not own shall notify
the owner or licensee of the information of any breach of the
security of the data immediately following discovery, if the
personal information was, or is reasonably believed to have
been, acquired by an unauthorized person.
(c) The notification required by this section may be delayed if a
law enforcement agency determines that the notification will
impede a criminal investigation. The notification required by this
section shall be made after the law enforcement agency
determines that it will not compromise the investigation.
(d) Any agency that is required to issue a security breach
notification pursuant to this section shall meet all of the
following requirements:
(1) The security breach notification shall be written in plain
language, shall be titled “Notice of Data Breach,” and shall
present the information described in paragraph (2) under the
following headings: “What Happened,” “What Information Was
Involved,” “What We Are Doing,” “What You Can Do,” and “For
More Information.” Additional information may be provided as a
supplement to the notice.
(A) The format of the notice shall be designed to call attention
to the nature and significance of the information it contains.
(B) The title and headings in the notice shall be clearly and
conspicuously displayed.
(C) The text of the notice and any other notice provided
pursuant to this section shall be no smaller than 10-point type.
778
(D) For a written notice described in paragraph (1) of subdivision
(i), use of the model security breach notification form prescribed
below or use of the headings described in this paragraph with the
information described in paragraph (2), written in plain language,
shall be deemed to be in compliance with this subdivision.
[Refer to statutory language for table contents -
(E) For an electronic notice described in paragraph (2) of
subdivision (i), use of the headings described in this paragraph
with the information described in paragraph (2), written in plain
language, shall be deemed to be in compliance with this
subdivision.
(2) The security breach notification described in paragraph (1)
shall include, at a minimum, the following information:
(A) The name and contact information of the reporting agency
subject to this section.
(B) A list of the types of personal information that were or are
reasonably believed to have been the subject of a breach.
(C) If the information is possible to determine at the time the
notice is provided, then any of the following: (i) the date of the
breach, (ii) the estimated date of the breach, or (iii) the date
range within which the breach occurred. The notification shall
also include the date of the notice.
(D) Whether the notification was delayed as a result of a law
enforcement investigation, if that information is possible to
determine at the time the notice is provided.
(E) A general description of the breach incident, if that
information is possible to determine at the time the notice is
provided.
(F) The toll-free telephone numbers and addresses of the major
credit reporting agencies, if the breach exposed a social security
number or a driver’s license or California identification card
number.
(3) At the discretion of the agency, the security breach
notification may also include any of the following:
779
(A) Information about what the agency has done to protect
individuals whose information has been breached.
(B) Advice on steps that the person whose information has been
breached may take to protect himself or herself.
(e) Any agency that is required to issue a security breach
notification pursuant to this section to more than 500 California
residents as a result of a single breach of the security system shall
electronically submit a single sample copy of that security breach
notification, excluding any personally identifiable information, to
the Attorney General. A single sample copy of a security breach
notification shall not be deemed to be within subdivision (f) of
Section 6254 of the Government Code.
(f) For purposes of this section, “breach of the security of the
system” means unauthorized acquisition of computerized data
that compromises the security, confidentiality, or integrity of
personal information maintained by the agency. Good faith
acquisition of personal information by an employee or agent of
the agency for the purposes of the agency is not a breach of the
security of the system, provided that the personal information is
not used or subject to further unauthorized disclosure.
(g) For purposes of this section, “personal information” means
either of the following:
(1) An individual’s first name or first initial and last name in
combination with any one or more of the following data
elements, when either the name or the data elements are not
encrypted:
(A) Social security number.
(B) Driver’s license number or California identification card
number.
(C) Account number, credit or debit card number, in
combination with any required security code, access code, or
password that would permit access to an individual’s financial
account.
(D) Medical information.
(E) Health insurance information.
780
(F) Information or data collected through the use or operation
of an automated license plate recognition system, as defined in
Section 1798.90.5.
(2) A user name or email address, in combination with a
password or security question and answer that would permit
access to an online account.
(h) (1) For purposes of this section, “personal information” does
not include publicly available information that is lawfully made
available to the general public from federal, state, or local
government records.
(2) For purposes of this section, “medical information” means
any information regarding an individual’s medical history, mental
or physical condition, or medical treatment or diagnosis by a
health care professional.
(3) For purposes of this section, “health insurance information”
means an individual’s health insurance policy number or
subscriber identification number, any unique identifier used by a
health insurer to identify the individual, or any information in an
individual’s application and claims history, including any appeals
records.
(4) For purposes of this section, “encrypted” means rendered
unusable, unreadable, or indecipherable to an unauthorized
person through a security technology or methodology generally
accepted in the field of information security.
(i) For purposes of this section, “notice” may be provided by one
of the following methods:
(1) Written notice.
(2) Electronic notice, if the notice provided is consistent with the
provisions regarding electronic records and signatures set forth in
Section 7001 of Title 15 of the United States Code.
(3) Substitute notice, if the agency demonstrates that the cost
of providing notice would exceed two hundred fifty thousand
dollars ($250,000), or that the affected class of subject persons to
be notified exceeds 500,000, or the agency does not have
781
sufficient contact information. Substitute notice shall consist of
all of the following:
(A) Email notice when the agency has an email address for the
subject persons.
(B) Conspicuous posting, for a minimum of 30 days, of the
notice on the agency’s Internet Web site page, if the agency
maintains one. For purposes of this subparagraph, conspicuous
posting on the agency’s Internet Web site means providing a link
to the notice on the home page or first significant page after
entering the Internet Web site that is in larger type than the
surrounding text, or in contrasting type, font, or color to the
surrounding text of the same size, or set off from the surrounding
text of the same size by symbols or other marks that call
attention to the link.
(C) Notification to major statewide media and the Office of
Information Security within the Department of Technology.
(4) In the case of a breach of the security of the system involving
personal information defined in paragraph (2) of subdivision (g)
for an online account, and no other personal information defined
in paragraph (1) of subdivision (g), the agency may comply with
this section by providing the security breach notification in
electronic or other form that directs the person whose personal
information has been breached to promptly change his or her
password and security question or answer, as applicable, or to
take other steps appropriate to protect the online account with
the agency and all other online accounts for which the person
uses the same user name or email address and password or
security question or answer.
(5) In the case of a breach of the security of the system involving
personal information defined in paragraph (2) of subdivision (g)
for login credentials of an email account furnished by the agency,
the agency shall not comply with this section by providing the
security breach notification to that email address, but may,
instead, comply with this section by providing notice by another
method described in this subdivision or by clear and conspicuous
782
notice delivered to the resident online when the resident is
connected to the online account from an Internet Protocol
address or online location from which the agency knows the
resident customarily accesses the account.
(j) Notwithstanding subdivision (i), an agency that maintains its
own notification procedures as part of an information security
policy for the treatment of personal information and is otherwise
consistent with the timing requirements of this part shall be
deemed to be in compliance with the notification requirements
of this section if it notifies subject persons in accordance with its
policies in the event of a breach of security of the system.
(k) Notwithstanding the exception specified in paragraph (4) of
subdivision (b) of Section 1798.3, for purposes of this section,
“agency” includes a local agency, as defined in subdivision (a) of
Section 6252 of the Government Code.
Title 1.81. Customer Records
1798.82 Security Breach Notification Requirements
(a) A person or business that conducts business in California,
and that owns or licenses computerized data that includes
personal information, shall disclose a breach of the security of
the system following discovery or notification of the breach in
the security of the data to a resident of California whose
unencrypted personal information was, or is reasonably believed
to have been, acquired by an unauthorized person. The
disclosure shall be made in the most expedient time possible and
without unreasonable delay, consistent with the legitimate needs
of law enforcement, as provided in subdivision (c), or any
measures necessary to determine the scope of the breach and
restore the reasonable integrity of the data system.
(b) A person or business that maintains computerized data that
includes personal information that the person or business does
not own shall notify the owner or licensee of the information of
the breach of the security of the data immediately following
783
discovery, if the personal information was, or is reasonably
believed to have been, acquired by an unauthorized person.
(c) The notification required by this section may be delayed if a
law enforcement agency determines that the notification will
impede a criminal investigation. The notification required by this
section shall be made promptly after the law enforcement
agency determines that it will not compromise the investigation.
(d) A person or business that is required to issue a security
breach notification pursuant to this section shall meet all of the
following requirements:
(1) The security breach notification shall be written in plain
language, shall be titled “Notice of Data Breach,” and shall
present the information described in paragraph (2) under the
following headings: “What Happened,” “What Information Was
Involved,” “What We Are Doing,” “What You Can Do,” and “For
More Information.” Additional information may be provided as a
supplement to the notice.
(A) The format of the notice shall be designed to call attention
to the nature and significance of the information it contains.
(B) The title and headings in the notice shall be clearly and
conspicuously displayed.
(C) The text of the notice and any other notice provided
pursuant to this section shall be no smaller than 10-point type.
(D) For a written notice described in paragraph (1) of subdivision
(j), use of the model security breach notification form prescribed
below or use of the headings described in this paragraph with the
information described in paragraph (2), written in plain language,
shall be deemed to be in compliance with this subdivision.
[Refer to statutory language for table contents -
(E) For an electronic notice described in paragraph (2) of
subdivision (j), use of the headings described in this paragraph
with the information described in paragraph (2), written in plain
language, shall be deemed to be in compliance with this
subdivision.
784
(2) The security breach notification described in paragraph (1)
shall include, at a minimum, the following information:
(A) The name and contact information of the reporting person
or business subject to this section.
(B) A list of the types of personal information that were or are
reasonably believed to have been the subject of a breach.
(C) If the information is possible to determine at the time the
notice is provided, then any of the following: (i) the date of the
breach, (ii) the estimated date of the breach, or (iii) the date
range within which the breach occurred. The notification shall
also include the date of the notice.
(D) Whether notification was delayed as a result of a law
enforcement investigation, if that information is possible to
determine at the time the notice is provided.
(E) A general description of the breach incident, if that
information is possible to determine at the time the notice is
provided.
(F) The toll-free telephone numbers and addresses of the major
credit reporting agencies if the breach exposed a social security
number or a driver’s license or California identification card
number.
(G) If the person or business providing the notification was the
source of the breach, an offer to provide appropriate identity
theft prevention and mitigation services, if any, shall be provided
at no cost to the affected person for not less than 12 months
along with all information necessary to take advantage of the
offer to any person whose information was or may have been
breached if the breach exposed or may have exposed personal
information defined in subparagraphs (A) and (B) of paragraph
(1) of subdivision (h).
(3) At the discretion of the person or business, the security
breach notification may also include any of the following:
(A) Information about what the person or business has done to
protect individuals whose information has been breached.
785
(B) Advice on steps that the person whose information has been
breached may take to protect himself or herself.
(e) A covered entity under the federal Health Insurance
Portability and Accountability Act of 1996 (42 U.S.C. Sec. 1320d
et seq.) will be deemed to have complied with the notice
requirements in subdivision (d) if it has complied completely with
Section 13402(f) of the federal Health Information Technology
for Economic and Clinical Health Act (Public Law 111-5).
However, nothing in this subdivision shall be construed to
exempt a covered entity from any other provision of this section.
(f) A person or business that is required to issue a security
breach notification pursuant to this section to more than 500
California residents as a result of a single breach of the security
system shall electronically submit a single sample copy of that
security breach notification, excluding any personally identifiable
information, to the Attorney General. A single sample copy of a
security breach notification shall not be deemed to be within
subdivision (f) of Section 6254 of the Government Code.
(g) For purposes of this section, “breach of the security of the
system” means unauthorized acquisition of computerized data
that compromises the security, confidentiality, or integrity of
personal information maintained by the person or business.
Good faith acquisition of personal information by an employee or
agent of the person or business for the purposes of the person or
business is not a breach of the security of the system, provided
that the personal information is not used or subject to further
unauthorized disclosure.
(h) For purposes of this section, “personal information” means
either of the following:
(1) An individual’s first name or first initial and last name in
combination with any one or more of the following data
elements, when either the name or the data elements are not
encrypted:
(A) Social security number.
786
(B) Driver’s license number or California identification card
number.
(C) Account number, credit or debit card number, in
combination with any required security code, access code, or
password that would permit access to an individual’s financial
account.
(D) Medical information.
(E) Health insurance information.
(F) Information or data collected through the use or operation
of an automated license plate recognition system, as defined in
Section 1798.90.5.
(2) A user name or email address, in combination with a
password or security question and answer that would permit
access to an online account.
(i) (1) For purposes of this section, “personal information” does
not include publicly available information that is lawfully made
available to the general public from federal, state, or local
government records.
(2) For purposes of this section, “medical information” means
any information regarding an individual’s medical history, mental
or physical condition, or medical treatment or diagnosis by a
health care professional.
(3) For purposes of this section, “health insurance information”
means an individual’s health insurance policy number or
subscriber identification number, any unique identifier used by a
health insurer to identify the individual, or any information in an
individual’s application and claims history, including any appeals
records.
(4) For purposes of this section, “encrypted” means rendered
unusable, unreadable, or indecipherable to an unauthorized
person through a security technology or methodology generally
accepted in the field of information security.
(j) For purposes of this section, “notice” may be provided by one
of the following methods:
(1) Written notice.
787
(2) Electronic notice, if the notice provided is consistent with the
provisions regarding electronic records and signatures set forth in
Section 7001 of Title 15 of the United States Code.
(3) Substitute notice, if the person or business demonstrates
that the cost of providing notice would exceed two hundred fifty
thousand dollars ($250,000), or that the affected class of subject
persons to be notified exceeds 500,000, or the person or
business does not have sufficient contact information. Substitute
notice shall consist of all of the following:
(A) Email notice when the person or business has an email
address for the subject persons.
(B) Conspicuous posting, for a minimum of 30 days, of the
notice on the Internet Web site page of the person or business, if
the person or business maintains one. For purposes of this
subparagraph, conspicuous posting on the person’s or business’s
Internet Web site means providing a link to the notice on the
home page or first significant page after entering the Internet
Web site that is in larger type than the surrounding text, or in
contrasting type, font, or color to the surrounding text of the
same size, or set off from the surrounding text of the same size
by symbols or other marks that call attention to the link.
(C) Notification to major statewide media.
(4) In the case of a breach of the security of the system involving
personal information defined in paragraph (2) of subdivision (h)
for an online account, and no other personal information defined
in paragraph (1) of subdivision (h), the person or business may
comply with this section by providing the security breach
notification in electronic or other form that directs the person
whose personal information has been breached promptly to
change his or her password and security question or answer, as
applicable, or to take other steps appropriate to protect the
online account with the person or business and all other online
accounts for which the person whose personal information has
been breached uses the same user name or email address and
password or security question or answer.
788
(5) In the case of a breach of the security of the system involving
personal information defined in paragraph (2) of subdivision (h)
for login credentials of an email account furnished by the person
or business, the person or business shall not comply with this
section by providing the security breach notification to that email
address, but may, instead, comply with this section by providing
notice by another method described in this subdivision or by
clear and conspicuous notice delivered to the resident online
when the resident is connected to the online account from an
Internet Protocol address or online location from which the
person or business knows the resident customarily accesses the
account.
(k) Notwithstanding subdivision (j), a person or business that
maintains its own notification procedures as part of an
information security policy for the treatment of personal
information and is otherwise consistent with the timing
requirements of this part, shall be deemed to be in compliance
with the notification requirements of this section if the person or
business notifies subject persons in accordance with its policies in
the event of a breach of security of the system.
789
GOVERNMENT CODE
9147.7
Joint Sunset Review Committee
9147.8
Joint Sunset Review Committee Report to Public
and Make recommendation to Legislature
11009.5
License Process for Business Displaced or Suffering
Economic Hardship due to Declared Emergency
9147.7 Joint Sunset Review Committee
(a) For the purpose of this section, “eligible agency” means any
agency, authority, board, bureau, commission, conservancy,
council, department, division, or office of state government,
however denominated, excluding an agency that is
constitutionally created or an agency related to postsecondary
education, for which a date for repeal has been established by
statute on or after January 1, 2011.
(b) The Joint Sunset Review Committee is hereby created to
identify and eliminate waste, duplication, and inefficiency in
government agencies. The purpose of the committee is to
conduct a comprehensive analysis over 15 years, and on a
periodic basis thereafter, of every eligible agency to determine if
the agency is still necessary and cost effective.
(c) Each eligible agency scheduled for repeal shall submit to the
committee, on or before December 1 prior to the year it is set to
be repealed, a complete agency report covering the entire period
since last reviewed, including, but not limited to, the following:
(1) The purpose and necessity of the agency.
(2) A description of the agency budget, priorities, and job
descriptions of employees of the agency.
(3) Any programs and projects under the direction of the
agency.
(4) Measures of the success or failures of the agency and
justifications for the metrics used to evaluate successes and
failures.
790
(5) Any recommendations of the agency for changes or
reorganization in order to better fulfill its purpose.
(d) The committee shall take public testimony and evaluate the
eligible agency prior to the date the agency is scheduled to be
repealed. An eligible agency shall be eliminated unless the
Legislature enacts a law to extend, consolidate, or reorganize the
eligible agency. No eligible agency shall be extended in
perpetuity unless specifically exempted from the provisions of
this section. The committee may recommend that the Legislature
extend the statutory sunset date for no more than one year to
allow the committee more time to evaluate the eligible agency.
(e) The committee shall be comprised of 10 members of the
Legislature. The Senate Committee on Rules shall appoint five
members of the Senate to the committee, not more than three
of whom shall be members of the same political party. The
Speaker of the Assembly shall appoint five members of the
Assembly to the committee, not more than three of whom shall
be members of the same political party. Members shall be
appointed within 15 days after the commencement of the regular
session. Each member of the committee who is appointed by the
Senate Committee on Rules or the Speaker of the Assembly shall
serve during that committee member’s term of office or until
that committee member no longer is a Member of the Senate or
the Assembly, whichever is applicable. A vacancy on the
committee shall be filled in the same manner as the original
appointment. Three Assembly Members and three Senators who
are members of the committee shall constitute a quorum for the
conduct of committee business. Members of the committee shall
receive no compensation for their work with the committee.
(f) The committee shall meet not later than 30 days after the
first day of the regular session to choose a chairperson and to
establish the schedule for eligible agency review provided for in
the statutes governing the eligible agencies. The chairperson of
the committee shall alternate every two years between a
Member of the Senate and a Member of the Assembly, and the
791
vice chairperson of the committee shall be a member of the
opposite house as the chairperson.
(g) This section shall not be construed to change the existing
jurisdiction of the budget or policy committees of the Legislature.
(h) This section shall not apply to the Bureau of Medical
Marijuana Regulation.
9148.52. Joint Sunset Review Committee Report to Public and
Make Recommendations to Legislature
(a) The Joint Sunset Review Committee established pursuant to
Section 9147.7 shall review all eligible agencies.
(b) The committee shall evaluate and make determinations
pursuant to Article 7.5 (commencing with Section 9147.7).
(c) Pursuant to an evaluation made as specified in this section,
the committee shall make a report which shall be available to the
public and the Legislature on whether an agency should be
terminated, or continued, or whether its functions should be
revised or consolidated with those of another agency, and
include any other recommendations as necessary to improve the
effectiveness and efficiency of the agency. If the committee
deems it advisable, the report may include proposed legislative
proposals that would carry out its recommendations.
11009.5 License Process for Business Displaced or Suffering
Economic Hardship due to Declared Emergency
(a) For purposes of this section:
(1) “Displaced” means a condition in which the person or
business is unable to return to the address of record or other
address associated with the license before experiencing
economic hardship.
(2) “Economic hardship” means the inability to pay living or
business expenses, unless otherwise defined by a state agency
pursuant to subdivision (c).
(3) “Emergency” means an emergency as defined in Section
8558 or a declared federal emergency.
792
(4) “License” includes, but is not limited to, a certificate,
registration, or other required document to engage in business.
(b) Notwithstanding any other law, a state agency that issues
any business license may establish a process for a person or
business that has been displaced or is experiencing economic
hardship as a result of an emergency to submit an application,
that the agency may grant, for a reduction or waiver of any fees
required by the agency to obtain a license, renew or activate a
license, or replace a physical license for display.
(c) A fee or waiver process established pursuant to subdivision
(b) shall specify, at a minimum, all of the following:
(1) The methodology used by the agency for determining
whether a person, as a result of an emergency, has been
displaced or is experiencing economic hardship.
(2) The procedure for applying for a reduction or fee waiver.
(3) That the application shall be made within one year of the
date on which the emergency was proclaimed or declared.
793
CALIFORNIA PUBLIC RESOURCES CODE
DIVISION 12.2 CONSUMER PRODUCTS CONTAINING
MERCURY
15025.
Definitions: Mercury-Added Novelty; Mercury
Fever Thermometer; School
15026.
Sale of Mercury Fever Thermometer Prohibited;
Exception
PUBLIC RESOURCES CODE
Division 12.2. Consumer Products Containing
Mercury
15025. Definitions: Mercury-Added Novelty, Mercury Fever
Thermometer, School
For purposes of this article, the following terms have the
following meanings:
(a) "Mercury-added novelty" means a mercury-added product
intended mainly for personal or household enjoyment or
adornment. A "mercury-added novelty" includes, but is not
limited to, any item intended for use as a practical joke, figurine,
adornment, toy, game, card, ornament, yard statue or figure,
candle, jewelry, holiday decoration, and item of apparel,
including footwear. "Mercury-added novelty" does not include a
product that contains no mercury other than in a mercury-added
button cell battery.
(b) "Mercury fever thermometer" means a mercury-added
product that is used for measuring body temperature. Mercury
fever thermometer does not include a digital thermometer that
uses mercury-added button cell batteries.
794
(c) "School" means any school used for the purpose of the
education of more than 12 children in kindergarten or any of
grades 1 to 12, inclusive.
15026. Sale of Mercury Fever Thermometer Prohibited;
Exception
(a) On and after July 1, 2002, no person, other than a person
licensed pursuant to Article 9 (commencing with Section 4140)of
Chapter 9 of Division 2 of the Business and Professions Code,
may sell at retail, or otherwise supply, a mercury fever
thermometer to a consumer or patient in this state. A mercury
fever thermometer may be sold at retail, or otherwise supplied
to a consumer or patient only upon the prescription of a
physician, dentist, veterinarian, or podiatrist. A mercury fever
thermometer sold at retail shall be accompanied by clear written
instructions concerning careful handling to avoid breakage and
proper cleanup should breakage occur.
(b) A violation of subdivision (a) is a violation of the
requirements of Chapter 9 (commencing with Section 4000) of
Division 2 of the Business and Professions Code and the California
State Board of Pharmacy shall enforce the requirements of
subdivision (a) in accordance with Chapter 9.
795
|