What Is California Welfare and Institutions Code 5328?

California Welfare and Institutions Code Section 5328 keeps your mental health treatment records confidential and spells out the limited circumstances in which a provider, facility, or agency may share them without your permission. The statute is part of the Lanterman-Petris-Short Act, but its reach is wider than involuntary psychiatric holds: it protects information gathered while you receive any services under six divisions of the Welfare and Institutions Code, from voluntary community mental health care to services for people with developmental disabilities.¹

Which Records Are Protected

Section 5328 declares confidential all information and records collected while providing services under Division 4 (state hospital services), Division 4.1 (community mental health services), Division 4.5 (services for people with developmental disabilities), Division 5 (the LPS Act itself), Division 6 (services for people with substance use disorders and sexually violent predators), and Division 7 (services for people with developmental disabilities in state facilities).¹

Protection applies whether you entered treatment voluntarily or involuntarily. It covers the fact that you received services at all, along with evaluations, conservatorship proceedings, and commitment hearings. Facilities, individual providers, and government agencies are all bound by the rule.

When Records Can Be Shared Without Your Consent

The statute lists specific situations where disclosure is permitted. Outside these, your information stays locked down.

Treatment and Care Coordination

Qualified professionals involved in your care may share information with each other for treatment or referrals. If a provider at one facility wants to share your records with a professional at a different facility who is not responsible for your care, your consent is required first.¹

Insurance and Benefit Claims

Records can be released to the extent necessary for you, or someone acting on your behalf, to file a claim for insurance, government aid, or medical assistance.¹ The disclosure is limited to what the claim actually requires. A facility cannot hand over your entire file simply because you filed an insurance claim.

Court Proceedings and Law Enforcement

Records can be shared during conservatorship proceedings, where a judge needs treatment information to decide whether continued involuntary care is appropriate.¹ A facility must also provide limited information to a law enforcement officer who presents a warrant for someone wanted on a serious or violent felony charge.

Research

Records may be used for research only under strict conditions. The Director of Health Care Services, the Director of State Hospitals, the Director of Social Services, or the Director of Developmental Services must establish rules for how the research is conducted, and an institutional review board must approve the study before any records are accessed.² Identifying details must be removed, and confidentiality rules remain in effect throughout the process.

Your Attorney

Your attorney can obtain your records on presenting a release you have signed. If you are unable to sign, facility staff may still release records after confirming the attorney’s identity and that the attorney genuinely represents your interests.¹ One limit runs through nearly all these exceptions: no provider is forced to reveal information that a patient’s family members shared in confidence.

The Duty to Warn a Potential Victim

One exception stands apart. Under subdivision (a)(18), if your psychotherapist believes you pose a serious danger of violence to an identifiable person, the therapist may release information to the potential victim, law enforcement, or county child welfare agencies as needed to protect that person.¹

This codifies the principle from the 1976 California Supreme Court case Tarasoff v. Regents of the University of California. In that decision, the court held that when a therapist determines, or reasonably should determine under professional standards, that a patient poses a serious danger of violence to another person, the therapist has an obligation to use reasonable care to protect the intended victim.³ That may mean warning the victim directly, alerting police, or taking whatever other steps the situation requires.

Authorizing Release Yourself

You can authorize release of your own records, but the statute imposes guardrails. With the approval of the treating clinician in charge of your care, you may designate specific people to receive your information.¹ If you are a conservatee or a minor admitted with parental consent, your conservator, parent, legal guardian, or a guardian ad litem may designate recipients in writing.

A valid authorization identifies the specific information to be released, the person or agency receiving it, and the purpose for the disclosure. A general, open-ended release does not satisfy the statute. If you authorize disclosure to a county patients’ rights advocate, you can revoke that authorization at any time, in writing or by oral declaration.¹

Electronic signatures are generally accepted for HIPAA-covered authorizations at the federal level, provided the facility has safeguards to verify your identity and protect the document from unauthorized access.⁴ Whether a particular California facility accepts electronic signatures depends on its own policies, so ask before assuming a digital form will work.

Seeing Your Own Records

California law generally gives patients the right to inspect and copy their own health records, including mental health records. A provider can refuse to let you see your mental health records only if the provider determines there is a substantial risk that viewing them would cause you significant harm.⁵ The refusal is not blanket. The provider must document it in writing, explain the specific harm anticipated, and include that explanation in your records.

Even when a provider withholds records from you directly, you have options. You can designate a licensed physician, psychologist, marriage and family therapist, clinical social worker, or professional clinical counselor to inspect the records on your behalf.⁵ The statute prohibits that professional from simply turning around and letting you see the withheld material.

How Section 5328 Fits With HIPAA

Federal HIPAA rules set a baseline for medical record privacy, but when a state law provides stronger protections, the state law controls. HIPAA functions as a floor, and covered entities must follow whichever rule gives you more privacy.⁶ Section 5328 is stricter in several ways. HIPAA generally allows providers to share health information for treatment purposes without specific patient authorization. Section 5328 requires your consent before a provider at one facility shares records with a professional at a different facility who is not directly responsible for your care. Because the state rule gives you greater privacy, it overrides the looser federal standard.

HIPAA adds its own layer for psychotherapy notes, the personal notes a therapist keeps separately from the official medical record. Under HIPAA, these notes require your written authorization before disclosure for almost any purpose, including treatment by another provider.⁴ That federal protection operates alongside Section 5328’s broader restrictions on all mental health records.

What Happens When the Law Is Violated

Section 5328 backs its confidentiality requirements with both criminal and civil consequences. Anyone who willfully and knowingly releases confidential information in violation of the statute commits a misdemeanor.²

Beyond criminal liability, patients whose records are improperly disclosed can file a civil lawsuit. Remedies include actual damages for the real financial and personal harm caused by the breach, and in egregious cases, punitive damages. Courts can also issue injunctive relief, meaning a court order directing the facility or individual to stop making further unauthorized disclosures.

If the disclosure also violates HIPAA, the federal Office for Civil Rights can impose separate civil penalties on top of any state consequences, with fines that scale based on the severity and willfulness of the violation.

1
California Legislative Information. California Code WIC 5328 – Confidentiality of Information and Records
2
California Legislative Information. California Welfare and Institutions Code 5328
3
Supreme Court of California Resources. Tarasoff v Regents of University of California – 17 Cal 3d 425
4
U.S. Department of Health and Human Services (HHS.gov). HIPAA Privacy Rule and Sharing Information Related to Mental Health
5
California Legislative Information. California Code HSC 123115
6
HHS.gov. Preemption of State Law