HIPAA laws in California work in layers. The federal HIPAA rules set a national floor for medical privacy, and California’s Confidentiality of Medical Information Act, along with a handful of other state statutes, adds stricter protections on top. Where state law gives patients more privacy than HIPAA requires, the state law controls, because HIPAA only preempts state rules that are less protective.1HHS.gov. Does the HIPAA Privacy Rule Preempt State Laws For patients, that means faster access to your own records, tighter rules around sensitive categories of information, and more places to turn when something goes wrong.
How the Two Laws Fit Together
HIPAA applies to health plans, healthcare clearinghouses, and providers who transmit health information electronically. It requires safeguards for individually identifiable health information, limits sharing without a patient’s authorization, and gives patients the right to see and copy their records.2HHS.gov. The HIPAA Privacy Rule
CMIA covers healthcare providers, health plans, pharmaceutical companies, and their contractors. It defines protected “medical information” broadly, reaching any individually identifiable information about a patient’s medical history, physical or mental condition, or treatment, whether stored electronically or on paper. When CMIA is stricter than HIPAA on the same subject, California providers follow CMIA.
A separate California layer, the California Consumer Privacy Act and the California Privacy Rights Act, generally does not touch information already protected by HIPAA or CMIA. Those consumer privacy laws matter for health-related data collected outside traditional healthcare, such as fitness tracker metrics, wellness app data, and pharmacy loyalty profiles held by businesses that are not HIPAA-covered entities.3State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
Faster Access to Your Own Records
The most concrete difference for patients is timing. Under California Health and Safety Code 123110, a provider must let you review your records within five business days of your request. If you want copies, the provider has 15 days to produce them. HIPAA gives a covered entity 30 calendar days, with a possible 30-day extension if the provider explains the delay in writing.4HHS.gov. How Timely Must a Covered Entity Be in Responding to an Individual’s Request for Access If a California provider misses the five- or 15-day deadline, you can file a complaint with the California Department of Public Health.
California caps copy charges at $0.25 per page for paper and $0.50 per page for copies from microfilm. A provider may add a reasonable cost-based fee for labor, but cannot use fees as a barrier to access. Electronic records should be provided in an accessible format at a reasonable cost. Unpaid medical bills are not a valid reason to withhold records.
Minors control access to records for care they legally consented to on their own. In California, minors can independently consent to reproductive healthcare, and minors aged 12 and older can consent to outpatient mental health treatment if the treating professional determines they are mature enough to participate. In those situations, the provider cannot release records to parents without the minor’s authorization.
If you spot an error in your records, HIPAA gives you the right to request an amendment. The provider must respond within 60 days, with one possible 30-day extension. If the request is denied, you can submit a written statement of disagreement that attaches to your record and travels with future disclosures.5eCFR. Amendment of Protected Health Information
Extra Protection for Sensitive Categories
California singles out certain kinds of health information for heightened confidentiality.
Mental Health Records
The Lanterman-Petris-Short Act restricts who can see mental health treatment records. As a rule, those records stay between the patient and the professionals directly providing or coordinating care. Sharing without patient authorization is permitted only in narrow situations, such as court-ordered disclosures, threats of serious violence against an identifiable victim, and communications between treating professionals within the same facility.6Guidance on Patient Authorization for LPS Mental Health Records. Patient Authorization Guidance LPS Mental Health
HIV Test Results
HIV results carry statutory protection under the Health and Safety Code. The general rule is that results cannot be disclosed without the patient’s written authorization. One carve-out lets the ordering physician share results with the patient’s other providers for diagnosis, care, or treatment, without a separate written consent.7California Legislative Information. California Code HSC Section 120985 Unauthorized disclosure of someone’s HIV status can also trigger liability under civil rights and anti-discrimination statutes.8California Legislative Information. California Code HSC Section 120990
Reproductive and Gender-Affirming Care
In 2022, California prohibited providers from releasing medical records about abortion care in response to out-of-state subpoenas, and a companion law ensured that pregnancy loss and abortion are not treated as criminal matters in California.9Governor of California. New Protections for People Who Need Abortion Care and Birth Control As of 2024, data related to abortion services and gender-affirming care must be segregated from the rest of a patient’s record when exchanged through health information exchanges, and providers must disable access to that segregated data by out-of-state entities. Contraception records received the same treatment.
When Providers Can Share Without Your Consent
Most disclosures require patient authorization, but California recognizes several exceptions.
Providers can share your records with other treating physicians, hospitals, and insurers to coordinate care and process claims. That covers the routine exchange that makes the system function.
Certain communicable diseases must be reported to local and state health authorities. Reportable conditions in California include tuberculosis, HIV, and COVID-19, among others. Lead poisoning and adverse vaccine reactions also trigger mandatory reporting.10Legal Information Institute. Cal Code Regs Tit 22, Section 97530.31 – Reporting of Communicable Diseases
Healthcare professionals must report suspected child abuse, elder abuse, and injuries from assaultive conduct. Under the Child Abuse and Neglect Reporting Act, mandated reporters must call immediately upon suspecting abuse and follow up with a written report within 36 hours. Practitioners who treat injuries from firearms or assaults must notify local law enforcement within two working days. Disclosures must be limited to relevant facts, and patients are typically notified unless notification would compromise an investigation.
One common misunderstanding worth flagging: HIPAA does not directly regulate what your employer asks you. Your employer can request a doctor’s note or health information for sick leave, workers’ compensation, wellness programs, or insurance purposes. The restriction falls on the provider. If your employer contacts your healthcare provider directly, the provider cannot release your information without your authorization unless another law compels disclosure.11HHS.gov. Employers and Health Information in the Workplace Employment records themselves, even when they contain health-related data, fall outside HIPAA’s scope.
Breach Notification Deadlines
When unsecured protected health information is breached, HIPAA requires covered entities to notify each affected individual within 60 calendar days of discovery. The notice must be in plain language and describe what happened, the types of information involved, steps the individual can take to protect themselves, what the entity is doing in response, and contact information for questions.12eCFR. 45 CFR 164.404 – Notification to Individuals Breaches affecting 500 or more people must also be reported to the HHS Secretary within 60 days.13HHS.gov. Submitting Notice of a Breach to the Secretary Smaller breaches must still be reported, though those reports can be batched annually.
California cuts the facility timeline much shorter. Under Health and Safety Code 1280.15, healthcare facilities must report breaches of patient medical information to the California Department of Public Health within 15 business days of detection.14California Department of Public Health. Medical Information Breach Regulation Text Missing that deadline can trigger penalties independent of any federal consequences.
Penalties for Violations
California enforces medical privacy through several agencies, with penalties that depend on who violated the rule, whether the violation was negligent or intentional, and whether anyone profited.
CMIA penalties under Civil Code 56.36 escalate with culpability. A negligent release lets the patient recover $1,000 in nominal damages without proving actual harm, plus any actual damages, and the violator faces an administrative fine of up to $2,500 per violation. Knowing and willful violations by non-licensed persons or entities can reach $25,000 per violation. Violations for financial gain by non-licensed actors can reach $250,000 per violation, plus disgorgement of profits. Licensed healthcare professionals acting for financial gain face a tiered structure: up to $5,000 for a first violation, $25,000 for a second, and $250,000 for a third or subsequent violation, plus disgorgement. These amounts are per violation, and a single breach affecting many patients can generate many violations.15California Legislative Information. California Civil Code 56.36
Facilities carry their own scheme. Health and Safety Code 1280.15 lets CDPH impose up to $25,000 per patient whose information was compromised at a clinic, hospital, home health agency, or hospice, plus up to $17,500 for each subsequent occurrence involving the same patient’s information.16California Legislative Information. California Health and Safety Code 1280.15 A breach affecting hundreds of patients can generate penalties in the millions.
The California Attorney General can also bring civil actions. In 2023, Kaiser agreed to a $49 million settlement after investigators found protected health information in unsecured dumpsters at facilities across the state. In 2019, Aetna paid $935,000 after a mailing vendor sent envelopes that revealed recipients’ HIV medication status through oversized windows.17State of California – Department of Justice – Office of the Attorney General. Privacy Enforcement Actions
Where to File a Complaint
The right agency depends on who violated your privacy.
- For healthcare facility breaches, file with the California Department of Public Health, online, by mail, or through a CDPH district office.18California Department of Public Health. Medical Breaches
- For provider misconduct, report to the Medical Board of California or the relevant licensing board for that profession.
- For health plan or insurance violations, contact the Department of Managed Health Care, which regulates most California health plans. If your plan falls under the Department of Insurance instead, DMHC will forward your complaint.19California Department of Managed Health Care. Frequently Asked Questions
- For federal HIPAA violations, file with the HHS Office for Civil Rights through its online complaint portal.20HHS.gov. Filing a Health Information Privacy Complaint
For federal complaints, you generally have 180 days from when you learned of the violation, though OCR can extend that deadline for good cause.21HHS.gov. How to File a Health Information Privacy or Security Complaint Patients harmed by a CMIA violation can also file a private lawsuit seeking nominal damages, actual damages, and attorney’s fees.15California Legislative Information. California Civil Code 56.36