A number of California and federal laws aim to protect the privacy of your medical information. But California Health and Safety Code §1280.15 has special significance because violations carry penalties. The law requires health facilities, hospices, home health agencies and clinics to “prevent unlawful or unauthorized access to, and use or disclosure of, patients’ medical information.”

The Department of Public Health can issue an administrative penalty of up to $25,000 per patient for violations.

The law also requires health facilities to self-report any unauthorized disclosures to both the patient and the Department of Public Health within five business days. Facility failure to report unauthorized disclosures is subject to a separate $100 penalty per day.

We hear many complaints that nursing homes release confidential information without a resident’s authorization, such as when a resident is trying to find a better facility. When these violations occur, it is a good idea to remind the Department of Public Health about this law and ask it to impose penalties when you file a complaint.