The California Confidentiality of Medical Information Act, codified at Civil Code Section 56 and following, restricts how healthcare providers, health plans, their contractors, pharmaceutical companies, and health-app developers collect, use, and disclose identifiable patient information. The default rule is simple: no covered entity may share your medical information without your written authorization, except in a narrow set of situations the statute spells out. Violations can bring civil damages starting at $1,000 per affected person, administrative fines reaching $250,000 per violation when records are exploited for financial gain, and misdemeanor charges when the breach causes economic loss or injury.
Who the Law Covers
The CMIA reaches four categories of entities operating in California.1California Legislative Information. California Code CIV 56.05 – Definitions
- Providers of health care, meaning anyone licensed or certified under the Business and Professions Code — physicians, nurses, dentists, chiropractors — along with clinics and hospitals licensed under the Health and Safety Code.
- Health care service plans regulated under the Knox-Keene Act, which includes most HMOs and managed-care plans.
- Contractors handling medical data on behalf of a provider or plan, such as medical groups, independent practice associations, pharmaceutical benefits managers, and medical service organizations.
- Pharmaceutical companies that manufacture, sell, or distribute prescription drugs.
The data at issue must be “medical information,” which the statute defines as individually identifiable records, electronic or physical, about a patient’s medical history, mental or physical condition, or treatment. Individually identifiable means the record contains a name, address, email, phone number, Social Security number, or similar detail that ties it to a specific person. If a dataset has been fully stripped of identifiers so no one could trace it back to any patient, the CMIA does not apply. That carve-out matters for research institutions and analytics companies working with aggregated health data.
Health Apps and Wearables Are Covered Too
The California Attorney General has said that the CMIA applies to businesses offering mobile apps or wearable devices designed to store medical information, even when those businesses are not covered by federal health privacy law.2State of California – Department of Justice – Office of the Attorney General. Attorney General Bonta Emphasizes Health Apps Legal Obligation to Protect Reproductive Health Information Fertility trackers, period-tracking apps, pregnancy-related connected products, and similar tools fall under the same disclosure rules as a hospital. If you use one of these apps in California, your data gets the same statutory protection as information in a doctor’s chart.
How the CMIA Compares to HIPAA
HIPAA applies to “covered entities”: health plans, healthcare clearinghouses, and providers who transmit health information electronically. The California statute reaches further. It covers every healthcare provider operating in the state, including small practices and individual practitioners who might not qualify as HIPAA-covered entities, plus pharmaceutical companies and health-app developers that HIPAA does not reach at all. When both laws apply to the same entity, the entity must follow whichever rule is more protective of the patient. Compliance with HIPAA alone is not enough in California.
When Disclosure Is Allowed Without Authorization
The baseline rule is that covered entities need the patient’s written authorization before releasing medical information.3California Legislative Information. California Civil Code 56.10 – Disclosure of Medical Information The exceptions divide into two groups.
Mandatory Disclosures
Covered entities must release records, regardless of the patient’s wishes, when compelled by a court order, an administrative or investigative subpoena, a discovery notice in litigation, a search warrant issued to law enforcement, or a coroner’s request in a death investigation. Other California laws that require disclosure — mandatory reporting of child abuse, elder abuse, or gunshot wounds, for example — also override the CMIA’s default confidentiality rule.4California Legislative Information. California Code CIV 56.10 – Disclosure of Medical Information by Providers
Permissive Disclosures
Even without written authorization, covered entities may share medical information for three practical purposes:
- Treatment, meaning disclosure to other providers, health plans, or healthcare professionals involved in diagnosing or treating the patient.
- Payment, limited to what is necessary for insurers, employers, or health plans to determine and process payment for care.
- Employment-related services, when a provider delivered care at the employer’s written request and expense. The provider may tell the employer about functional limitations affecting the employee’s ability to work or eligibility for medical leave, but may not share the underlying diagnosis.
Outside those exceptions, covered entities cannot intentionally sell medical information, use it for marketing, or repurpose it for anything unrelated to the patient’s care.
What a Valid Authorization Must Contain
When no exception applies, the CMIA sets specific requirements for the authorization itself. A signature on a generic release form is often not enough.5California Legislative Information. California Code CIV 56.11 – Authorization Requirements
The authorization must be handwritten by the person signing it or printed in type no smaller than 14 points. It has to be clearly separated from any other language on the page, and the signature cannot do double duty — a single signature line that both authorizes disclosure and consents to treatment is invalid.
The document must include all of the following:
- The specific types of medical information to be disclosed and any limits on that disclosure.
- The name or function of the entity authorized to release the information.
- The name or function of the person or entity authorized to receive it.
- The specific permitted uses of the information by the recipient.
- An expiration date after which the authorization is no longer valid.
- Notice of the signer’s right to receive a copy of the authorization.
Who signs matters too. Generally the patient signs. A legal representative may sign for a minor or an adult who lacks capacity. A spouse or financially responsible person may sign only when the sole purpose is processing a health insurance or benefit-plan application. For a deceased patient, the beneficiary or personal representative may authorize disclosure.
An authorization missing any required element is invalid, and a release based on a defective authorization is treated as an unauthorized disclosure, which puts the entity on the hook for the full range of CMIA penalties.
Penalties for Violations
The CMIA’s penalties run on parallel tracks. One unauthorized disclosure can trigger criminal liability, civil damages payable to the patient, and administrative fines, and the amounts climb based on how deliberate the violation was.
Criminal Exposure
Any CMIA violation that causes economic loss or personal injury is punishable as a misdemeanor.6California Legislative Information. California Code CIV 56.36 – Penalties and Remedies The statute does not require proof of intent for this charge. A negligent disclosure that produces financial harm can still land the violator in criminal court.
Civil Damages
A patient whose records were released negligently can sue for $1,000 in nominal damages per violation without proving any actual harm. If the breach did cause real injury — identity theft, lost employment, emotional distress — the patient can recover actual damages on top of or in place of the nominal award. The statute also allows recovery of reasonable attorney’s fees and costs.
Administrative and Civil Fines
Beyond damages owed to the patient, violators face per-violation fines that scale with intent and the violator’s status:
- Negligent disclosure: up to $2,500 per violation, whether or not the patient suffered actual damages.
- Knowing and willful violation by a non-licensed entity: up to $25,000 per violation.
- Knowing and willful violation by a licensed health care professional: up to $2,500 for a first offense, $10,000 for a second, and $25,000 for a third or later violation.
- Violation for financial gain by a non-licensed entity: up to $250,000 per violation, plus disgorgement of profits earned from the misuse.
- Violation for financial gain by a licensed professional: up to $5,000 for a first offense, $25,000 for a second, and $250,000 for a third or later violation, plus disgorgement.
The split between licensed professionals and other entities is deliberate. A corporate hospital or data contractor that knowingly violates the law faces the maximum fine from the first incident. A licensed individual gets a graduated scale, but that leniency disappears by the third offense, and anyone profiting from patient data faces the steepest numbers the statute allows.
These penalties stack rather than substitute. One negligent disclosure can produce a misdemeanor charge, a $1,000 nominal damages award, a $2,500 administrative fine, and an order to pay the patient’s attorney’s fees. In a breach affecting thousands of patients, the per-violation arithmetic adds up quickly. The statute states explicitly that imposing one penalty does not block imposing others authorized by law.