|
This publication is also available as a pdf file: download now
California’s Confidentiality of Medical Information Act (CMIA) regulates the disclosure of most health care records.5 It states that, in general, health care providers cannot share or release individual medical information without written authorization. Cal. Civil Code § 56.10(a).
The authorization must be signed by a parent or guardian when the parent or guardian consented for the minor’s health care . Conversely, the authorization must be signed by the minor when the minor consented for health care or could have consented to the care under law. Cal. Civil Code § 56.11(c)(1)&(2).
There are exceptions . State law allows certain persons to inspect records without the need for an authorization. For example, minors have the right to inspect their own records when the records pertain to health care for which the minor consented or could have consented. Cal. Health & Safety Code § 123110(a). And parents and guardians have the right to inspect their children’s records, as long as the records do not pertain to care for which the minor consented or could have consented. Cal. Civil Code § 56.10(b)(7); Cal. Health & Safety Code §§ 123110(a), 123115(a)(1).
Federal regulations also address access to medical records . Federal HIPAA regulations generally restate California law — establishing that when a parent consents for an unemancipated minor’s health care, that parent generally has a right to control access to the minor’s medical information . The HIPAA regulations also honor a minor’s right under state law to control access to her own records when the minor consented for that care . 45 C .F .R . §§ 164 .502(a)(1)(i)&(iv); (a)(2)(i); (g)(1); (g)(3)(i) .
CMIA and HIPAA establish certain general rules about access to medical information; however, there are exceptions to both the federal and state laws that change access rights in some instances.
Under state law, providers may refuse to provide parents or guardians access to a minor’s medical records when “the health care provider determines that access to the patient records requested by the [parent or guardian] would have a detrimental effect on the provider’s professional relationship with the minor patient or the minor’s physical safety or psychological well-being.” Cal. Health & Safety Code § 123115(a)(2).
Providers applying this exception in good faith to limit parent access to records shall not be liable for their refusal to share records. Cal. Health & Safety Code § 123115(a)(2).
The following confidentiality rules apply when minors satisfy these status conditions:
When an emancipated minor consents for care, a health care provider is not permitted to share information or records with a parent without the minor’s written authorization. Cal. Civil Code §§ 56.10, 56.11; Cal. Health & Safety Code §§ 123110(a), 123115(a)(1).
When a minor consents for care under this section, “A physician and surgeon or dentist may, with or without the consent of the minor patient, advise the minor’s parent or guardian of the treatment given or needed if the physician and surgeon or dentist has reason to know, on the basis of the information given by the minor, the whereabouts of the parent or guardian.” Cal. Family Code § 6922(c).
The following confidentiality rules apply when minors receive these services:
A health care provider is not permitted to share information or records regarding abortion services with a parent or legal guardian without the minor’s written authorization. Cal. Civil Code §§ 56.10, 56.11; Cal. Health & Safety Code §§ 123110(a), 123115(a)(1).
Federal regulations establish special protections for substance abuse treatment records . Providers who meet certain criteria must follow the federal rule . (For criteria, see footnote six below.)6
For those providers who must comply with federal rules, the federal regulations prohibit disclosing any information to parents without a minor’s written consent if the minor acting alone under applicable state law has the legal capacity to apply for and obtain alcohol or drug abuse treatment. 42 C.F.R. § 2.14. However, a provider or program may share with parents if the individual or program director (if it is a program) determines the following three conditions are met: (1) that the minor’s situation poses a substantial threat to the life or physical well-being of the minor or another; (2) that this threat may be reduced by communicating relevant facts to the minor’s parents; and (3) that the minor lacks the capacity because of extreme youth or a mental or physical condition to make a rational decision on whether to disclose to her parents. 42 C.F.R. §2.14.
For providers who do not have to follow the federal rules, state law applies. Under state law, if a parent or guardian consents for a minor’s drug or alcohol treatment, “the physician [must] disclose medical information concerning the care to the minor’s parent or legal guardian upon his or her request, even if the minor child does not consent to disclosure, without liability for the disclosure.” Cal. Family Code § 6929(g).
State law says that when a minor consents for her own drug or alcohol treatment, a health care provider is not permitted to share records with a parent or legal guardian without the minor’s written authorization. Cal. Civil Code §§ 56.10(a), 56.11(c); Cal. Health & Safety Code §§ 123110(a), 123115(a)(1). At the same time, state law requires health care providers to involve the minor’s parent or guardian in the treatment plan, if appropriate, as determined by the professional person or treatment facility treating the minor. The professional person providing care to the minor must state in the minor’s treatment record whether and when the professional attempted to contact the minor’s parent or guardian, and whether the attempt was successful, or the reason why, in the opinion of the professional person, it would not be appropriate to contact the minor’s parent or guardian. Cal. Family Code § 6929(c).
Involving parents in treatment will necessitate sharing certain otherwise confidential information; however, having them participate does not mean parents have a right to access all confidential records . Providers should attempt to honor the minor’s right to confidentiality to the extent possible while still involving parents in treatment.
Federal regulations establish special confidentiality protections for family planning information gathered during a Title X funded service . Providers delivering services funded in full or in part with Title X monies must comply with the federal regulations.
For agencies delivering services funded in full or in part by Title X, federal law mandates that “[a]ll information as to personal facts and circumstances obtained by the project staff about individuals receiving services must be held confidential and must not be disclosed without the individual’s documented consent, except as may be necessary to provide services to the patient or as required by law, with appropriate safeguards for confidentiality.” 42 C.F.R. 59.11. This regulation supersedes any state law to the contrary.
Thus, if a minor receives Title X funded services, the records cannot be disclosed to parents without obtaining the minor’s documented consent.
For agencies delivering services funded in full or in part by Title X, federal law mandates that “[a]ll information as to personal facts and circumstances obtained by the project staff about individuals receiving services must be held confidential and must not be disclosed without the individual’s documented consent, except as may be necessary to provide services to the patient or as required by law, with appropriate safeguards for confidentiality.” 42 C.F.R. § 59.11.
For all other services, state law applies. California law says that a health care provider is not permitted to share information or records regarding the prevention or treatment of a minor’s pregnancy with a parent or legal guardian without the minor’s written authorization. Cal. Civil Code §§ 56.10(a), 56.11(c); Cal. Health & Safety Code §§ 123110(a), 123115(a)(1).
For agencies delivering services funded in full or in part by Title X, federal law mandates that “[a]ll information as to personal facts and circumstances obtained by the project staff about individuals receiving services must be held confidential and must not be disclosed without the individual’s documented consent, except as may be necessary to provide services to the patient or as required by law, with appropriate safeguards for confidentiality.” 42 C.F.R. § 59.11.
For all other services, state law applies. California law says that a health care provider is not permitted to share information or records regarding a minor’s HIV/AIDS services with a parent or legal guardian without the minor’s written authorization. Cal. Civil Code §§ 56.10(a), 56.11(c); Cal. Health & Safety Code §§ 123110(a), 123115(a)(1).
A health care provider is not permitted to share information or records regarding a minor’s treatment for reportable diseases with a parent or legal guardian without the minor’s written authorization. Cal. Civil Code §§ 56.10, 56.11; Cal. Health & Safety Code §§ 123110(a), 123115(a)(1).
A health care provider is not permitted to share records regarding minor consent mental health care with a parent or legal guardian without the minor’s authorization. Cal. Civil Code §§ 56.10(a), 56.11(c); Cal. Health & Safety Code §§ 123110(a), 123115(a)(1).
At the same time, state law requires health care providers to involve a parent or guardian in the minor’s treatment unless, in the opinion of the professional person who is treating the minor, the involvement would be inappropriate. The professional must state in the client record whether and when the professional attempted to contact the minor’s parent or guardian, and whether the attempt was successful, or the reason why, in the professional person’s opinion, it would be inappropriate to contact the minor’s parent or guardian. Cal. Family Code § 6924(d).
Involving parents in treatment will necessitate sharing certain otherwise confidential information; however, having them participate does not mean parents have a right to access all confidential records . Providers should attempt to honor the minor’s right to confidentiality to the extent possible while still involving parents in treatment.
For agencies delivering services funded in full or in part by Title X, federal law mandates that “[a]ll information as to personal facts and circumstances obtained by the project staff about individuals receiving services must be held confidential and must not be disclosed without the individual’s documented consent, except as may be necessary to provide services to the patient or as required by law, with appropriate safeguards for confidentiality.” 42 C.F.R. § 59.11.
For all other services, state law applies. California law says that a health care provider is not permitted to share information or records regarding the prevention or treatment of a minor’s pregnancy with a parent or legal guardian without the minor’s written authorization. Cal. Civil Code §§ 56.10(a), 56.11(c); Cal. Health & Safety Code §§ 123110(a), 123115(a)(1).
For minors 12 and older:
A health care provider is not permitted to share information or records about rape treatment with a parent or legal guardian without the minor’s written authorization. Cal. Civil Code §§ 56.10, 56.11; Cal. Health & Safety Code §§ 123110(a), 123115(a)(1).
For minors under 12 years of age:
The health care provider must attempt to contact the minor’s parent or guardian and must note in the minor’s rape treatment record the date and time of the attempted contact and whether it was successful. This provision does not apply if the treating professional reasonably believes that the parent or guardian committed the sexual assault. Cal. Family Code § 6928(c).
The health care provider must attempt to contact the minor’s parent or guardian and must note in the minor’s sexual assault treatment record the date and time of the attempted contact and whether it was successful. This provision does not apply if the treating professional reasonably believes that the parent or guardian committed the sexual assault. Cal . Family Code § 6928(c) .
For agencies delivering services funded in full or in part by Title X, federal law mandates that “[a]ll information as to personal facts and circumstances obtained by the project staff about individuals receiving services must be held confidential and must not be disclosed without the individual’s documented consent, except as may be necessary to provide services to the patient or as required by law, with appropriate safeguards for confidentiality.” 42 C.F.R. § 59.11.
For all other services, state law applies. California law says that a health care provider is not permitted to share information or records regarding a minor’s STD services with a parent or legal guardian without the minor’s written authorization. Cal. Civil Code §§ 56.10(a), 56.11(c); Cal. Health & Safety Code §§ 123110(a), 123115(a)(1).
Neither the physician-patient privilege nor the psychotherapist-patient privilege applies to information reported pursuant to this law in any court proceeding. Cal. Penal Code § 11171.2(b).
State and federal confidentiality laws contain many exceptions that allow or require providers to share medical information, whether or not they have parent or minor authorization. Examples include:
“It shall be the duty of every health care provider, knowing of or in attendance on a case or suspected case of any of the diseases or conditions listed [in the regulations], to report to the local health officer for the jurisdiction where the patient resides as required . . . .” 17 C.C.R. § 2500(b).
The CMIA permits, but does not require, a health care provider to furnish medical information, without need of an authorization, to providers of health care, health care service plans, contracts, or other health care professionals or facilities for purposes of diagnosis or treatment of the patient. Cal. Civil Code § 56.10(c)(1). However, a recipient of medical information pursuant to this exception may not further disclose that medical information --except with an authorization signed by the patient or the patient representative, or as otherwise required or permitted by law. Cal. Civil Code § 56.13.
The CMIA permits, but does not require, a health care provider to disclose health information, without need of an authorization, to an insurer, employer, health care service plan, hospital service plan, employee benefit plan, governmental authority, contractor, or any other person or entity responsible for paying for health care services rendered to the patient, to the extent necessary to allow responsibility for payment to be determined and payment to be made. Cal. Civil Code § 56.10(c)(2). However, a recipient of medical information pursuant to this exception may not further disclose that medical information -— except with an authorization signed by the patient or the patient representative, or as otherwise required or permitted by law. Cal. Civil Code § 56.13.
Mandated reporters of child abuse must make a child abuse report whenever they have knowledge of or observe a child whom they know or reasonably suspect has been the victim of child abuse or neglect. Cal. Penal Code §§ 11165.7, 11166.
To the extent that this reporting requirement conflicts with CMIA, the reporting requirement prevails. People ex rel. Eicheberger v. Stockton Pregnancy Control Medical Clinic, Inc., 249 Cal. Rptr. 762, 768 (3rd Dist. Ct. App. 1988).
Providers can only share information without client authorization if an exception in state or federal law specifically allows the release. If no exception applies that would allow a provider to share information, providers who reveal confidential information without authorization may be held liable. For example, providers who reveal confidential information in violation of California’s Confidentiality of Medical Information Act can be held criminally and civilly liable. Cal. Civil Code §§ 56.35, 56.36. In addition, the Department of Health and Human Services has the authority to enforce HIPAA confidentiality regulations and to impose sanctions on providers who breach those rules. See 42 U.S.C. 1320d-6; 45 C.F.R. § 160, Subpart C.
Beyond criminal and civil sanction, professionals who violate confidentiality also put their medical license at risk. For example, certain health care providers who “willfully” fail to respect the laws related to patient access to health records (Health and Safety Code sections 123110 et seq.) are guilty of “unprofessional conduct.” State law requires the state agency, board or commission that issued the providers’ professional license to consider such a violation as grounds for disciplinary action, including suspension or revocation of the license. Cal. Health & Safety Code § 123110(i).
5. The CMIA applies to most but not all medical records. For example, it does not apply to certain mental health and drug treatment records. Other statutes protect the confidentiality of these records. See Cal. Civil Code § 56.30 for complete CMIA coverage list.
6. Federal confidentiality law applies to any individual, program, or facility that meets the following two criteria:
1. The individual, program, or facility is federally assisted. (Federally assisted means authorized, certified, licensed or funded in whole or in part by any department of the federal government. Examples include programs that are: tax exempt; receiving tax-deductible donations; receiving any federal operating funds; or registered with Medicare.) 42 C.F.R. §2.12;
And:
2. The individual or program:
- Is an individual or program that holds itself out as providing alcohol or drug abuse diagnosis, treatment, or referral; OR
- Is a staff member at a general medical facility whose primary function is, and who is identified as, a provider of alcohol or drug abuse diagnosis, treatment or referral; OR
- Is a unit at a general medical facility that holds itself out as providing alcohol or drug abuse diagnosis, treatment or referral. 42 C.F.R. § 2.11; 42 C.F.R. § 2.12.
