California Civil Code. California
Section 56.11 or Section 56.21 permitting such use or disclosure, except as follows:
(1) The information may be disclosed if the disclosure is compelled by judicial or administrative process or by any other specific provision of law.
(2) That part of the information which is relevant in a lawsuit, arbitration, grievance, or other claim or challenge to which the employer and employee are parties and in which the patient has placed in issue his or her medical history, mental or physical condition, or treatment may be used or disclosed in connection with that proceeding.
(3) The information may be used only for the purpose of administering and maintaining employee benefit plans, including health care plans and plans providing short-term and long-term disability income, workers’ compensation and for determining eligibility for paid and unpaid leave from work for medical reasons.
(4) The information may be disclosed to a provider of health care or other health care professional or facility to aid the diagnosis or treatment of the patient, where the patient or other person specified in subdivision (c) of Section 56. 21 is unable to authorize the disclosure.
(d) If an employer agrees in writing with one or more of its employees or maintains a written policy which provides that particular types of medical information shall not be used or disclosed by the employer in particular ways, the employer shall obtain an authorization for such uses or disclosures even if an authorization would not otherwise be required by subdivision (c).
(Repealed and added by Stats. 1981, Ch. 782, Sec. 2.)
56.21. An authorization for an employer to disclose medical information shall be valid if it complies with all of the following:
(a) Is handwritten by the person who signs it or is in a typeface no smaller than 14-point type.
(b) Is clearly separate from any other language present on the same page and is executed by a signature that serves no purpose other than to execute the authorization.
(c) Is signed and dated by one of the following:
(1) The patient, except that a patient who is a minor may only sign an authorization for the disclosure of medical information obtained by a provider of health care in the course of furnishing services to which the minor could lawfully have consented under Part 1 (commencing with Section 25) or Part 2.7 (commencing with Section 60) of Division 1.
(2) The legal representative of the patient, if the patient is a minor or incompetent. However, authorization may not be given under this subdivision for the disclosure of medical information that pertains to a competent minor and that was created by a provider of health care in the course of furnishing services to which a minor patient could lawfully have consented under Part 1 (commencing with Section 25) or Part 2.7 (commencing with Section 60) of Division 1.
(3) The beneficiary or personal representative of a deceased patient.
(d) States the limitations, if any, on the types of medical information to be disclosed.
(e) States the name or functions of the employer or person authorized to disclose the medical information.
(f) States the names or functions of the persons or entities authorized to receive the medical information.
(g) States the limitations, if any, on the use of the medical information by the persons or entities authorized to receive the medical information.
(h) States a specific date after which the employer is no longer authorized to disclose the medical information.
(i) Advises the person who signed the authorization of the right to receive a copy of the authorization.
(Amended by Stats. 2006, Ch. 538, Sec. 39. Effective January 1, 2007.)
56.22. Upon demand by the patient or the person who signed an authorization, an employer possessing the authorization shall furnish a true copy thereof.
(Repealed and added by Stats. 1981, Ch. 782, Sec. 2.)
56.23. An employer that discloses medical information pursuant to an authorization required by this chapter shall communicate to the person or entity to which it discloses the medical information any limitations in the authorization regarding the use of the medical information. No employer that has attempted in good faith to comply with this provision shall be liable for any unauthorized use of the medical information by the person or entity to which the employer disclosed the medical information.
(Added by Stats. 1981, Ch. 782, Sec. 2.)
56.24. Nothing in this part shall be construed to prevent a person who could sign the authorization pursuant to subdivision (c) of Section 56.21 from cancelling or modifying an authorization. However, the cancellation or modification shall be effective only after the employer actually receives written notice of the cancellation or modification.
(Repealed and added by Stats. 1981, Ch. 782, Sec. 2.)
56.245. A recipient of medical information pursuant to an authorization as provided by this chapter may not further disclose such medical information unless in accordance with a new authorization that meets the requirements of Section 56. 21, or as specifically required or permitted by other provisions of this chapter or by law.
(Added by Stats. 1981, Ch. 782, Sec. 2.)
CHAPTER 4. Relationship of Chapters 2 and 3 [56.25–56.25.]
(Chapter 4 added by Stats. 1981, Ch. 782, Sec. 2.)
56.25. (a) An employer that is a provider of health care shall not be deemed to have violated Section 56.20 by disclosing, in accordance with Chapter 2 (commencing with Section 56.10), medical information possessed in connection with providing health care services to the provider’s patients.
(b) An employer shall not be deemed to have violated Section 56.20 because a provider of health care that is an employee or agent of the employer uses or discloses, in accordance with Chapter 2 (commencing with Section 56.10), medical information possessed by the provider in connection with providing health care services to the provider’s patients.
(c) A provider of health care that is an employer shall not be deemed to have violated Section 56.10 by disclosing, in accordance with Chapter 3 (commencing with Section 56.20), medical information possessed in connection with employing the provider’s employees. Information maintained by a provider of health care in connection with employing the provider’s employees shall not be deemed to be medical information for purposes of Chapter 3 (commencing with Section 56.20), unless it would be deemed medical information if received or maintained by an employer that is not a provider of health care.
(Repealed and added by Stats. 1981, Ch. 782, Sec. 2.)
CHAPTER 5. Use and Disclosure of Medical and Other Information by Third Party Administrators and Others [56.26 — 56.265]
(Heading of Chapter 5 amended by Stats. 2000, Ch. 278, Sec. 1.)
56.26. (a) No person or entity engaged in the business of furnishing administrative services to programs that provide payment for health care services shall knowingly use, disclose, or permit its employees or agents to use or disclose medical information possessed in connection with performing administrative functions for a program, except as reasonably necessary in connection with the administration or maintenance of the program, or as required by law, or with an authorization.
(b) An authorization required by this section shall be in the same form as described in Section 56.21, except that “third party administrator” shall be substituted for “employer” wherever it appears in Section 56.21.
(c) This section shall not apply to any person or entity that is subject to the Insurance Information Privacy Act or to Chapter 2 (commencing with Section 56.10) or Chapter 3 (commencing with Section 56.20).
(Amended by Stats. 2004, Ch. 183, Sec. 24. Effective January 1, 2005.)
56.265. A person or entity that underwrites or sells annuity contracts or contracts insuring, guaranteeing, or indemnifying against loss, harm, damage,