California medical records laws give you a legal right to see and copy your own health information quickly, limit who else can access it, and layer state protections on top of federal HIPAA rules. When the two frameworks disagree, the stricter one controls, and in most practical areas, California is the stricter one.
How Fast You Can Get Your Records
Under California Health and Safety Code 123110, any adult patient or authorized representative can ask to inspect or copy their medical records. The deadlines depend on what you’re asking for. In-person inspection must be allowed during business hours within five working days of your request. Paper or electronic copies must be sent within 15 days.1California Legislative Information. California Health and Safety Code 123110 (2025)
A separate 30-day deadline applies when you need records to support a claim or appeal for a public benefit program such as Medi-Cal. In that situation the provider cannot charge you anything, but you’ll need to include proof that the records are needed for the benefit claim with your written request.1California Legislative Information. California Health and Safety Code 123110 (2025)
California’s timelines are shorter than HIPAA, which gives providers up to 30 calendar days to respond with one possible 30-day extension. When the state deadline is faster, your provider has to meet it.2HHS.gov. Individuals’ Right Under HIPAA to Access Their Health Information
If your records are kept electronically, you can request them in a specific format such as PDF or a structured clinical data file. The provider must deliver whatever format you ask for, as long as the system can readily produce it. If it can’t, the provider must offer alternative electronic options, and can only fall back to paper if you decline every available electronic format.3HHS.gov. When an Individual Exercises Her HIPAA Right to Get an Electronic Copy of Her PHI Separately, under the 21st Century Cures Act, providers cannot use technology or policies to interfere with your ability to access, download, or share your own electronic health data, and finalized electronic health information including clinical notes and test results must be released to you without delay and at no cost.
What It Can Cost
For standard copy requests, providers can charge a reasonable, cost-based fee that covers labor, supplies, and postage. The per-page cap is $0.25 for paper copies and $0.50 for records copied from microfilm. Requests tied to a public benefit claim must be free.1California Legislative Information. California Health and Safety Code 123110 (2025)
When a Provider Can Deny Access
A California provider can withhold records if a licensed health care professional determines that releasing the information would cause substantial harm to your physical or mental health. The provider must document the reason and tell you that you can designate another licensed professional to review the records on your behalf.1California Legislative Information. California Health and Safety Code 123110 (2025)
HIPAA allows denials in a few additional situations: when a professional concludes the information could endanger your life or someone else’s physical safety, or when the records reference another person and releasing them could cause that person substantial harm. You have the right to have the denial reviewed by a different licensed professional who was not involved in the original decision.4eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
Who Else Can See Your Records
Under the Confidentiality of Medical Information Act (CMIA), a provider cannot share your medical information with a third party without your written authorization unless a specific legal exception applies. The authorization has to be specific. It must list the exact types of information being released, who may disclose it, who is authorized to receive it, the intended use, and an expiration date. A general authorization for “all medical information” is not sufficient under California law.5California Legislative Information. California Civil Code 56.10
The CMIA also carves out situations where providers must or may share records without your consent:
- Court orders, administrative subpoenas, and valid search warrants issued to a law enforcement agency.5California Legislative Information. California Civil Code 56.10
- Law enforcement requests outside of a court order or warrant, which require either your prior written consent or a court order showing good cause.6Justia Law. California Penal Code 1543-1545 – Disclosure of Medical Records to Law Enforcement Agencies
- Mandatory public health reporting of certain communicable diseases and adverse events.
- Disclosures to coroners and medical examiners to identify a deceased person, locate next of kin, or investigate deaths involving public health concerns or suspected abuse.
- Workers’ compensation claims, where insurers and employers may access records related to a workplace injury, limited to information relevant to that specific claim.
Even when a disclosure is authorized by law, only the minimum information necessary for the stated purpose should be released. Unrelated history should stay out.
Records That Get Extra Protection
Certain categories of health information carry heightened confidentiality rules on top of the standard CMIA framework.
Psychotherapy Records
Before anyone can access outpatient psychotherapy records, even an entity otherwise authorized under the CMIA must submit a separate written request identifying the specific information sought, its intended use, how long it will be kept before destruction, and a statement that the records won’t be used for any other purpose. The requesting party must send a copy of that written request to the patient within 30 days of receiving the records, unless the patient has waived notice.
HIV and AIDS Records
Public health records containing personally identifying HIV or AIDS information are confidential and can only be disclosed for public health purposes or with the patient’s written authorization. They cannot be used in any civil, criminal, or administrative proceeding, and cannot be used to determine employability or insurability. Unauthorized disclosure carries separate civil penalties: up to $5,000 for negligent disclosure and between $5,000 and $25,000 for willful or malicious disclosure.7Justia Law. California Health and Safety Code 121025-121035
Substance Use Disorder Records
Federal regulations under 42 CFR Part 2 impose restrictions on substance use disorder treatment records that go beyond both HIPAA and the CMIA. These records cannot be used to bring criminal charges against a patient, and a general authorization for medical records is explicitly not enough to permit their release. Any disclosure made with patient consent must include a written notice prohibiting the recipient from further sharing the records in legal proceedings without a court order.8eCFR. 42 CFR Part 2 No California law can override these federal protections.
Parents, Minors, and Confidential Care
Parents and legal guardians generally have the right to access a minor child’s medical records, but California carves out important exceptions. Under Health and Safety Code 123115, a parent’s access is blocked when the minor lawfully consented to the treatment, when a provider determines that parental access would harm the provider-patient relationship or the minor’s safety, or when the records relate to specific types of confidential care.9California Legislative Information. California Health and Safety Code 123115
The confidential care category is broader than many parents expect. A minor aged 12 or older can independently consent to outpatient mental health counseling, drug and alcohol treatment, and certain reproductive healthcare including contraception.10National Center for Youth Law. California Minor Consent and Confidentiality Compendium 2024 When a minor consents to any of those services, the minor controls the related records, and the provider cannot disclose that information to a parent without the minor’s release.
Records of a Deceased Patient
HIPAA protections for a deceased person’s health information last 50 years after death. During that period, the personal representative of the deceased, typically the executor or administrator of the estate, has the same access and authorization rights the patient would have had.11HHS.gov. Health Information of Deceased Individuals A provider may also share relevant information with a family member or other person who was involved in the individual’s care or payment before death, unless doing so would conflict with a preference the deceased expressed while alive. In practice, establishing your right usually takes a death certificate plus a court document such as letters testamentary.
Fixing Wrong Information in Your File
You can ask a provider to correct information in your record. Under HIPAA, the provider must act on your request within 60 days, with one possible 30-day extension if they notify you of the delay in writing. The provider can deny the request if the information is accurate and complete, was not created by that provider, or is not part of the designated record set.12eCFR. 45 CFR 164.526
If the provider denies your amendment request, you can submit a written statement of disagreement that becomes a permanent part of your record. The provider may add its own rebuttal, but must include your statement with any future disclosure of the disputed information.
Separately, any correction or update to an electronic medical record must include a timestamp and explanation, and the original entry must remain visible even after the change.13HHS.gov. Summary of the HIPAA Security Rule
How Long Providers Must Keep Records
Licensed healthcare facilities in California must retain patient records for at least seven years after the patient’s last encounter. For minors, records must be kept until at least one year after the patient turns 18, and never for less than seven years total.14Cornell Law School. California Code of Regulations Title 22, Section 72543 Individual physicians face the same seven-year minimum under Business and Professions Code 2266, and failure to maintain adequate records can trigger discipline by the Medical Board.15California Legislative Information. California Business and Professions Code 2266 (2025) After the retention period expires, records must be destroyed completely: paper shredded, electronic files permanently deleted or overwritten.
What Happens When There’s a Breach
California’s breach notification law is one of the strictest in the country. If a business or individual that handles computerized personal data, including medical information, discovers a security breach affecting California residents, they must notify those residents within 30 calendar days.16California Legislative Information. California Civil Code 1798.82
The notification must be titled “Notice of Data Breach,” written in plain language, and organized under required headings: “What Happened,” “What Information Was Involved,” “What We Are Doing,” “What You Can Do,” and “For More Information.” It must list the types of information compromised, the date or estimated date range of the breach, and the entity’s contact information. Delay is permitted only to accommodate a law enforcement investigation or to determine the scope of the breach and restore data system integrity.
HIPAA adds a separate layer. Providers must notify affected individuals within 60 days of discovering a breach of unsecured protected health information. When a breach affects 500 or more people, the provider must also notify HHS and prominent media outlets in the affected area within the same 60-day window. Smaller breaches can be reported to HHS annually, no later than 60 days after the end of the calendar year.17HHS.gov. Breach Notification Rule Because California’s 30-day deadline is shorter, providers in the state have to meet the state timeline for notifications sent to individuals.
Penalties for Violations
CMIA penalties are tiered by intent. Negligent disclosure of medical information carries a maximum penalty of $2,500 per violation. Knowingly and willfully obtaining, disclosing, or using medical information in violation of the CMIA raises the cap to $25,000 per violation for non-licensed entities. Licensed health professionals face a graduated scale: up to $2,500 on a first offense, $10,000 on a second, and $25,000 on a third or subsequent violation.18California Legislative Information. California Civil Code 56.36
When a violation is committed for financial gain, non-licensed entities face up to $250,000 per violation plus disgorgement of any profits. Licensed professionals face graduated penalties up to $250,000 by the third offense. Any CMIA violation that causes economic loss or physical injury to a patient is also punishable as a misdemeanor. Patients can file private lawsuits seeking $1,000 in nominal damages per violation regardless of whether they suffered actual harm, and actual damages can be recovered on top of that.18California Legislative Information. California Civil Code 56.36
Federal HIPAA penalties are adjusted annually for inflation. As of 2026, the tiers run from $145 per violation at the lowest level (did not know, could not have known) up to $2,190,294 per violation at the top (willful neglect, not corrected within 30 days), with a shared calendar year cap of $2,190,294 for identical violations.19Federal Register. Annual Civil Monetary Penalties Inflation Adjustment A California provider who violates both the CMIA and HIPAA can face state and federal penalties simultaneously.