California’s Confidentiality of Medical Information Act expands privacy protections beyond HIPAA in several concrete ways: it demands more detailed written authorizations, forces faster breach notifications, carries higher civil penalties, lets patients sue directly, and blocks certain out-of-state subpoenas and warrants that federal law alone would allow. If you receive care in California, both laws apply to your records, and your provider has to follow whichever one gives you more protection on any given point.
Why Both Laws Apply at Once
HIPAA sets a national floor for medical privacy, not a ceiling. Under 45 CFR ยง 160.203, HIPAA preempts conflicting state laws, but it carves out an exception for state laws that are “more stringent” than the federal rules.1eCFR. 45 CFR 160.203 – General Rule and Exceptions A state law counts as more stringent when it gives individuals greater privacy protection or greater rights over their health information.2U.S. Department of Health and Human Services. Preemption of State Law
The CMIA clears that bar in several places. A provider who is fully HIPAA-compliant can still violate California law by using a release form that meets federal standards but falls short of the state’s more detailed requirements. The practical rule for California providers: follow whichever law is stricter on each point.
Stricter Authorization Rules
HIPAA requires written authorization for most disclosures outside treatment, payment, and operations, but the CMIA layers specific formatting and content requirements on top. Under California Civil Code 56.11, every authorization must meet all of the following:
- Be handwritten by the person signing it, or printed in type no smaller than 14-point font.
- Be clearly separate from any other language on the page.
- Carry a signature that serves no other purpose than executing the authorization.
- State the specific types of medical information to be disclosed, who may disclose it, who may receive it, and the specific permitted uses.
- Include an expiration date or triggering event, generally capped at one year unless the patient requests longer.
These rules exist to stop blanket consent forms from sweeping up more information than you meant to share. A bundled signature on a thick stack of intake paperwork, or a release printed in small type as a paragraph inside another document, fails California’s test even if HIPAA would accept it.
The CMIA also narrows who can sign on another person’s behalf. A spouse or financially responsible party can sign only for the limited purpose of processing a health insurance application where the patient would be an enrolled dependent. Minors sign for themselves when the records concern care they were legally entitled to consent to on their own, such as certain reproductive health or mental health services.3California Legislative Information. California Civil Code CIV 56.11
Faster Breach Notification
If a healthcare facility discovers that your medical information has been compromised, California requires written notice to you within 15 business days of detecting the breach. HIPAA’s breach notification rule allows up to 60 calendar days in most cases, so California cuts that window dramatically.4California Department of Public Health. Medical Information Breach Regulation Text
The notice itself has to be written in plain language and include what happened and when, the types of information involved (such as name, Social Security number, or diagnosis), steps you should take to protect yourself, what the facility is doing to investigate and prevent future breaches, and contact information including a toll-free number.4California Department of Public Health. Medical Information Breach Regulation Text
A Private Right of Action and Higher Penalties
Perhaps the biggest practical difference is that the CMIA lets patients sue. HIPAA has no private right of action; enforcement runs through the federal Office for Civil Rights. California Civil Code 56.36 lets a patient recover nominal damages of $1,000 per violation for a negligent release of confidential medical information, without having to prove actual harm, and lets the patient also recover actual damages when there are measurable losses.5California Legislative Information. California Civil Code 56.36 – Violations
Administrative fines sit on top of what a patient can recover. For non-licensed persons and entities, negligent disclosures reach up to $2,500 per violation, knowing and willful violations up to $25,000, and violations for financial gain up to $250,000 plus disgorgement of any profits. Licensed healthcare professionals face a tiered schedule that starts lower on a first offense but climbs to the same $250,000-plus-disgorgement ceiling for repeat financial-gain violations.6California Legislative Information. California Civil Code 56.36 Any violation that causes economic loss or personal injury to a patient is also chargeable as a misdemeanor.5California Legislative Information. California Civil Code 56.36 – Violations
Businesses that aren’t traditional providers can still be on the hook. Under Civil Code 56.06, companies that offer software or hardware for maintaining medical information, or that process or store it, must meet the same confidentiality standards as a provider and face the same penalties for improper use or disclosure.7California Legislative Information. California Civil Code 56.06
Limits on Out-of-State Subpoenas and Warrants
California has used the CMIA to block certain legal demands from other states that HIPAA would not stop on its own. A foreign subpoena from another state must be accompanied by a California court order before a provider can comply. The CMIA also bars compliance with out-of-state search warrants that would violate California law, including the state’s Reproductive Privacy Act.8California Legislative Information. California Civil Code 56.10 – Disclosure of Medical Information by Providers
HIPAA itself doesn’t distinguish between in-state and out-of-state legal process; its subpoena rule focuses on patient notice and protective orders. California’s additional screen means a provider served with a subpoena from another state has to look past the federal checklist and ask whether the demand satisfies California’s gatekeeping requirements too.
Where HIPAA Still Does Work Alone
HIPAA doesn’t disappear just because the CMIA is stricter in these areas. For subpoenas that aren’t backed by a court order, HIPAA adds a safeguard that the CMIA doesn’t spell out: the requesting party must provide satisfactory assurance that the patient was notified and given time to object, or obtain a qualified protective order limiting the use of the information to the litigation and requiring its return or destruction afterward. A provider who releases records on a bare subpoena without those protections risks liability under both laws.
HIPAA’s access right is also what lets you direct a provider to transmit a copy of your records to a person or entity you designate.9U.S. Department of Health and Human Services. Individuals’ Right Under HIPAA to Access Their Health Information California’s Health and Safety Code supplies the inspection and copy-fee mechanics, with a five-working-day inspection window, a 15-day deadline for copies, and a $0.25-per-page cap for standard paper copies.10California Legislative Information. California Health and Safety Code 123110 The two frameworks sit side by side.
What the CMIA Doesn’t Reach
The CMIA is broad, but not everything a healthcare company holds about you is CMIA-protected medical information. The California Consumer Privacy Act generally does not apply to data already governed by the CMIA or HIPAA, so you won’t typically use CCPA deletion or opt-out rights against clinical records at your doctor’s office. The flip side is that data a healthcare organization collects outside the clinical relationship, such as website browsing behavior, marketing information, and app usage, can fall outside both the CMIA and HIPAA and become subject to CCPA instead. The line between exempt and non-exempt data is still being worked out in enforcement.
Federally assisted substance use disorder treatment records sit under a separate federal regime, 42 CFR Part 2, which has historically required its own specific written consent for disclosure. A 2024 final rule, with compliance dates through early 2026, moved Part 2 closer to HIPAA by allowing a single consent for future disclosures related to treatment, payment, and healthcare operations, and letting HIPAA-covered recipients redisclose those records under standard HIPAA rules.11U.S. Department of Health and Human Services. Fact Sheet 42 CFR Part 2 Final Rule If your care involves a Part 2 program, that layer applies in addition to the CMIA and HIPAA.
For most Californians, though, the practical takeaway is simple. Your provider has to meet California’s stricter authorization formatting, notify you within 15 business days of a breach, and face both administrative fines and your own lawsuit if your records are mishandled. HIPAA alone wouldn’t give you any of that.