The CMIA: What California’s Medical Privacy Law Adds to HIPAA for a Practice

Last reviewed: October 2026

TL;DR — Key Takeaways

• A provider of health care, a health care service plan or a contractor may not disclose a patient’s medical information without an authorization, unless the Act requires or permits it.
• An authorization is valid if it meets the Act’s conditions, and a minor may sign only for information from services the minor could lawfully consent to under the Family Code.
• A covered clinic, health facility, home health agency or hospice must report unauthorized access to, or disclosure of, medical information to the department within 15 business days of detection.
• A breach is treated as detected on the first business day it is known, or by exercising reasonable diligence would have been known, to the facility or its business associate.
• California law can require a business conducting business there to notify residents whose personal information an unauthorized person acquired, within 30 calendar days of discovery or notification, unless lawfully delayed.
• Within 15 calendar days of a required notice to over 500 Californians of one breach, a business must electronically send the Attorney General a sample, excluding any personally identifiable information.

California’s Confidentiality of Medical Information Act, the CMIA, adds a state layer to HIPAA. It bars a provider of health care, a health care service plan or a contractor from disclosing a patient’s medical information without an authorization, except where the Act requires or permits the disclosure; it sets its own conditions for a valid authorization; it requires providers, plans, pharmaceutical companies and contractors to preserve the confidentiality of medical information, with change-tracking rules for electronic health record systems; and it lets patients recover damages and sets a fine for negligent disclosures in violation of the Act. Two related state laws add a breach report within 15 business days of detection for clinics, health facilities, home health agencies and hospices, and a breach notice to affected California residents, generally within 30 calendar days, from any business that conducts business in California and owns or licenses computerized data that includes personal information.

What the CMIA is, and how it sits next to HIPAA

The part of the California Civil Code that begins at section 56 may be cited as the Confidentiality of Medical Information Act, usually shortened to the CMIA. It is a state law with its own definitions, disclosure rules, authorization form, damages and penalties. A HIPAA program is built to the federal standard; the CMIA sets its own terms alongside it.

The federal rules, with two sections comparing them to the CMIA, are in our post on HIPAA compliance for a California clinic. This post stays on the state side.

Who the Act reaches

The Act’s duties attach to the persons each rule names, so the definitions come first.

For the Act, a provider of health care is a person licensed or certified under division 2 of the Business and Professions Code, or licensed under the Osteopathic or Chiropractic Initiative Act. It is also a person certified under division 2.5 of the Health and Safety Code, or a clinic, health dispensary or health facility licensed under division 2 of that Code. It does not include an insurance institution as the Insurance Code defines it.

Medical information is any individually identifiable information, in electronic or physical form, held by or derived from a provider of health care, health care service plan, pharmaceutical company or contractor. It covers only information about a patient’s medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment.

Businesses the Act deems providers

The Act deems some businesses to be providers of health care subject to its requirements. Some of them are:

• a business organized to maintain medical information and make it available to an individual or a provider of health care, at the request of either, so the individual can manage the individual’s information or for diagnosis and treatment;
• a business offering consumers software or hardware designed to maintain medical information and make it available to an individual or provider at either’s request, so the individual can manage it, or to diagnose, treat or manage a medical condition;
• a business that offers a consumer a mental health digital service, or a reproductive or sexual health digital service, so the individual can manage the individual’s information or for the diagnosis, treatment or management of a medical condition; and
• starting January 1, 2027, a business that offers a consumer a health care chatbot for those purposes.

A business deemed a provider must maintain the same standards of confidentiality required of a provider of health care for medical information disclosed to it. That status applies only for the Act, not for other laws, even laws that incorporate the Act’s definitions.

An app-based or remote care business also faces an entity question, covered in our post on telehealth business formation in California.

The default rule: no disclosure without an authorization

A provider of health care, a health care service plan or a contractor may not disclose a patient’s medical information without first obtaining an authorization, except as the Act’s list of required disclosures or its list of permitted disclosures provides.

One required disclosure runs to the patient: disclosure is compelled when the patient or the patient’s representative seeks it under the patient-access chapter of the Health and Safety Code, which begins at section 123100.

The permitted list is long. Three entries carry much of a practice’s daily traffic:

• Treatment. A provider may disclose medical information to other providers, plans, contractors or health care professionals or facilities for the diagnosis or treatment of the patient.
• Payment. A provider may disclose medical information to an insurer, employer, plan, governmental authority or other payer to the extent necessary to determine responsibility for payment and to obtain payment.
• Administration. A provider may disclose medical information to a person or entity that provides billing, claims management, medical data processing or other administrative services for providers, health care service plans or the payers in the payment entry. The recipient may not further disclose it in a way that would violate the Act.

Selling, marketing and immigration enforcement

The Act limits how a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates may use medical information. Except as the patient expressly authorizes or the required and permitted lists provide, none may intentionally share, sell, use for marketing, or otherwise use medical information for a purpose not necessary to provide the patient health care services.

The same providers, plans, contractors and corporations may not disclose medical information for immigration enforcement, except:

• as the patient expressly authorizes;
• as the required list requires; or
• as the permitted list permits.

Identifying information about a patient’s immigration status, including current and prior status, or place of birth, is treated as medical information when a provider knows or collects it as part of the patient’s medical history.

When a disclosure needs an authorization, and what makes it valid

Anyone who wants medical information covered by the general rule must obtain a valid authorization for its release, except as one paragraph of the permitted list provides. This duty does not apply to a person or entity the required or permitted lists authorize to receive the information.

A signature alone does not make the form valid. An authorization for the release of medical information by a provider, plan, pharmaceutical company or contractor is valid if it meets the conditions the Act lists, including that it:

• is handwritten or in a typeface no smaller than 14-point type;
• is clearly separate from any other language on the same page and is executed by a signature that serves no other purpose than to execute it;
• is signed, with an electronic or handwritten signature, and dated by the patient or another person section 56.11(b)(3) lists;
• states the specific uses and limits on the types of medical information to be disclosed;
• states the name or functions of the provider, plan, pharmaceutical company or contractor that may disclose the information, and of the persons or entities authorized to receive it;
• states the specific uses and limits on the recipients’ use of the information;
• states an expiration date or event that limits it to one year or less, unless the signer requests a specific date beyond a year. For an approved clinical trial or medical research study, it may run beyond one year if the expiration date or event extends no longer than the trial’s or study’s completion; and
• advises the signer of the right to receive a copy.

The patient may sign and date the authorization, but a patient who is a minor may sign only for the release of medical information obtained in furnishing services to which the minor could lawfully have consented under the Family Code. A legal representative may sign for a patient who is a minor or lacks capacity, but not for the release of information from those services.

A provider, plan, pharmaceutical company, contractor or other entity that seeks an individual’s authorization for a use or disclosure of protected health information must give the individual a copy of the signed authorization. It must also give instructions on how to access additional copies or a digital version of the signed authorization.

If you are getting ready for this step, we can help you check the papers and the timing first. Call (650) 668-8000 in Northern California or (213) 668-8000 in Southern California, or use baylegal.com/contact-us.

What a recipient may do with the information

A recipient of medical information under an authorization, or under the permitted list, may not further disclose it except in two cases. It may disclose it under a new authorization that meets the Act’s authorization rules, or as other provisions of the chapter or other law specifically require or permit. The administrative-services entry above carries its own version of this limit for billing and other administrative-services vendors.

The duty to keep medical information confidential

Every provider of health care, health care service plan, pharmaceutical company or contractor that creates, maintains, preserves, stores, abandons, destroys or disposes of medical information must do so in a way that preserves its confidentiality, and one that does so negligently is subject to the remedies and penalties in subdivisions (b) and (c) of section 56.36.

In J.M. v. Illuminate Education, Inc. (2026) 19 Cal.5th 705, the California Supreme Court held that a plaintiff suing under section 56.101 for failure to preserve the confidentiality of medical information does not need to show that an unauthorized person actually viewed the information; confidentiality is breached when the information is “exposed to a significant risk of unauthorized access or use.” That risk must rest on facts showing that unauthorized access or use is reasonably likely, and it does not exist where, for example, stolen data is protected by robust encryption. In J.M. v. Illuminate Education, Inc. (2026) 19 Cal.5th 705, the Supreme Court held that the complaint did not allege facts showing that an education technology company that held student health information for school districts’ educational planning was a business the Act deems a provider, and sent the case back for the lower courts to decide whether the complaint could be amended.

The Act’s electronic-record rules apply to an electronic medical record or electronic health record that meets the federal definition of an electronic health record. Such a system must protect and preserve the integrity of electronic medical information. It must also automatically record and preserve every change or deletion of electronically stored medical information. Each record must show the identity of the person who accessed and changed the information, the date and time it was accessed, and the change made.

Retention, the records custodian and patient notice when a practice winds down are covered in our post on closing a medical practice in California.

What a patient can recover, and the fine for negligence

The Act gives a remedy to a patient whose medical information was used or disclosed in violation of section 56.10, 56.104, 56.107 or 56.20, or subdivision (a) of section 56.26. If that patient sustained economic loss or personal injury from it, the patient may recover compensatory damages, punitive damages of up to $3,000, attorney’s fees of up to $1,000, and the costs of litigation. A violation of the Act that results in economic loss or personal injury to a patient is a misdemeanor.

An individual may sue a person or entity that negligently released confidential information or records about the individual in violation of the Act. The individual may seek nominal damages, actual damages or both. Except as the statute’s subdivision (e) provides, nominal damages are $1,000 and do not require proof of actual damage. Actual damages are the amount sustained, if any.

A person or entity that negligently discloses medical information in violation of the Act is also liable for an administrative fine or civil penalty of up to $2,500 per violation, regardless of the patient’s damages.

The Act gives a defendant in an individual’s negligence action an affirmative defense, and a defendant that proves it is liable for actual damages and reasonable attorney’s fees and costs, but not nominal damages.

If you want to know how this applies to your own situation, call Bay Legal at (650) 668-8000 in Northern California or (213) 668-8000 in Southern California, or reach us through baylegal.com/contact-us.

Breach reports for clinics and health facilities

A separate state law in the Health and Safety Code sets a breach report for clinics, health facilities, home health agencies and hospices.

A clinic, health facility, home health agency or hospice covered by that law must report any unlawful or unauthorized access to, or use or disclosure of, a patient’s medical information to the state department that law designates. It must make that report no later than 15 business days after it detects the access, use or disclosure. Subject to an exception in subdivision (c) of that law, it must also report to the affected patient or the patient’s representative within the same 15 business days. The patient notice may go by email only if the patient previously agreed in writing to electronic notice by email.

Under the department’s breach regulation, a health care facility, other than a business associate, must report to the department a breach of a patient’s medical information, or a breach reasonably believed to have occurred. The report is due no later than 15 business days after the breach is detected.

The regulation also fixes when that clock starts. A breach is detected when it is discovered or when the facility or its business associate reasonably believes it occurred. It is treated as detected on the first business day on which it is known to the facility or business associate, or by exercising reasonable diligence would have been known. The facility or business associate is deemed to know of a breach when any workforce member or agent, other than the person committing the breach, knows or by reasonable diligence would have known of it.

Internal paper records, email or faxes inadvertently misdirected within the same facility or health care system in the course of coordinating care or delivering services are not an unauthorized access, use or disclosure under the statute.

After investigation, the department may assess an administrative penalty of up to $25,000 per patient whose medical information was unlawfully or without authorization accessed, used or disclosed. It may also assess up to $17,500 per later occurrence of unlawful or unauthorized access, use or disclosure of that patient’s information. For a late report, the department may assess a penalty of $100 for each day after the initial 15-day period that the breach is not reported to the department or the patient. That penalty is the department’s choice, not automatic. The combined penalty for one reported event may not exceed $250,000.

The breach notice any business owes California residents

California’s data breach notice law is not limited to health care. It applies to an individual or business that conducts business in California and owns or licenses computerized data that includes personal information. After discovery or notification of a breach of the security of the system, the individual or business must disclose the breach to a California resident in either of these cases:

• The resident’s unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
• The resident’s encrypted personal information and the encryption key or security credential were, or are reasonably believed to have been, acquired by an unauthorized person.

For encrypted information, notice is owed only if the owner or licensee reasonably believes the key or credential could make the information readable or usable.

The second case applies only if the owner or licensee reasonably believes the key or credential could make the information readable or usable.

For this rule, personal information includes a person’s first name or first initial and last name together with medical information or health insurance information, when either the name or the data element is not encrypted. It also includes a username or email address together with a password or security question and answer that would permit access to an online account, such as a patient portal account.

The notice must be made within 30 calendar days of discovery or notification of the breach. The notice may be delayed for the legitimate needs of law enforcement, or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system. The law in its current form, as amended by SB 446, has been in effect since January 1, 2026.

A billing or records vendor can carry a duty of its own. An individual or business that maintains computerized data including personal information it does not own must notify the owner or licensee of a breach of the security of the data immediately following discovery. That duty arises if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

A business that must notify more than 500 California residents of a single breach must electronically submit a single sample copy of the notice to the Attorney General. The copy must exclude any personally identifiable information and is due within 15 calendar days of notifying the affected consumers.

A HIPAA covered entity that has complied completely with section 13402(f) of the federal HITECH Act is deemed to have complied with the notice requirements in subdivision (d) of the state law, but is not exempt from any other provision of it; the federal rules are covered in our HIPAA post.

Waivers and conditions of care

A patient’s waiver of the Act’s provisions, except as sections 56.11 and 56.21 and subdivision (b) of section 56.26 authorize, is contrary to public policy and unenforceable. No provider of health care may require a patient, as a condition of receiving care, to sign an authorization, release, consent or waiver that would permit a disclosure the law otherwise forbids.

When the Act may not reach you, and when HIPAA is not enough

Not every business near health care is bound by the rules written for providers. The Act’s definition of a provider of health care turns on specific licenses and certifications and excludes insurance institutions as the Insurance Code defines them. A business the Act deems a provider is treated as one for this Act only, not for other laws. A business outside both groups may not be bound by the rules that name providers. Several rules also name plans, contractors, pharmaceutical companies or corporations. The breach notice law reaches any individual or business that conducts business in California and owns or licenses computerized data that includes personal information. The California Supreme Court read the Act’s coverage of businesses that maintain medical information narrowly, as summarized above.

A working HIPAA program can still leave gaps under the Act. The Act sets its own authorization conditions, down to type size and the signature; its own nominal damages and negligence fine; and its own bar on conditioning care on a waiver. California’s breach notice law adds its own clock and filing, and a covered entity’s complete compliance with the HITECH provision above is deemed to meet that law’s notice requirements in subdivision (d), not the rest of it.

The Act also has separate rules for sensitive-services records and for out-of-state requests, in sections 56.101(c), 56.108, 56.109 and 56.110, which this post does not cover.

If you are deciding what to do next, we would rather talk it through early than after the fact. Call Bay Legal at (650) 668-8000 in Northern California or (213) 668-8000 in Southern California, or reach us through baylegal.com/contact-us.

When we review a provider’s privacy program against the Act, we look at:

• whether each business in the arrangement is a provider of health care, a deemed provider or neither;
• which permitted disclosures its operations rely on;
• whether its authorization form meets every listed condition;
• how its record system logs changes; and
• which breach rules would apply and when their clocks would start.

That review is part of our California healthcare business attorney practice.

Frequently Asked Questions

Does HIPAA compliance mean a practice complies with the CMIA?

Not by itself. The CMIA applies through its own definitions and sets its own authorization conditions, nominal damages, negligence fine and bar on conditioning care on a waiver. On breach notice, a HIPAA covered entity that has complied completely with section 13402(f) of the federal HITECH Act is deemed to have complied with the notice requirements in subdivision (d) of California’s breach notice law, but is not exempt from any other provision of that law.

Can a patient sue over a negligent release if no harm was shown?

In many cases, yes. An individual may sue a person or entity that negligently released confidential information or records about the individual in violation of the Act. Except as the statute’s subdivision (e) provides, the individual may recover nominal damages of $1,000 without proof of actual damage. The individual may also recover any actual damages sustained. A defendant that proves the Act’s affirmative defense is liable for actual damages and reasonable attorney’s fees and costs, but not nominal damages.

Can a provider make patients sign a privacy waiver at intake?

No provider of health care may require a patient, as a condition of receiving care, to sign an authorization, release, consent or waiver that would permit a disclosure the law otherwise forbids. A patient’s waiver of the Act’s provisions, except as sections 56.11 and 56.21 and subdivision (b) of section 56.26 authorize, is contrary to public policy and unenforceable.

When does a clinic or health facility have to report a breach?

A clinic, health facility, home health agency or hospice covered by the state’s facility breach law must report unlawful or unauthorized access to, or use or disclosure of, a patient’s medical information to the department. It must make that report no later than 15 business days after it detects the access, use or disclosure. Subject to an exception in the statute, it must also report to the affected patient or the patient’s representative within the same 15 business days. The patient notice may go by email only if the patient previously agreed in writing to electronic notice by email. Under the department’s regulation, a breach is treated as detected on the first business day it is known to the facility or its business associate, or by exercising reasonable diligence would have been known. The knowledge of any workforce member or agent, other than the person committing the breach, counts. Internal paper records, email or faxes inadvertently misdirected within the same facility or health care system in the course of coordinating care or delivering services are not an unauthorized access, use or disclosure under the statute.

What breach notice does a business owe California residents and the Attorney General?

An individual or business that conducts business in California and owns or licenses computerized data that includes personal information must disclose a breach of the security of the system to affected California residents. That duty covers a resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. It also covers a resident whose encrypted personal information and encryption key or security credential were so acquired, if the owner or licensee reasonably believes the key or credential could make the information readable or usable. The notice is due within 30 calendar days of discovery or notification of the breach. It may be delayed for the legitimate needs of law enforcement, or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system. A vendor that maintains computerized data including personal information it does not own must notify the owner or licensee immediately following discovery of a breach. This applies if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. A business that must notify more than 500 California residents of a single breach must electronically submit a single sample copy of the notice to the Attorney General. The copy must exclude any personally identifiable information and is due within 15 calendar days of notifying the affected consumers.

Legal References

• Confidentiality of Medical Information Act, Cal. Civ. Code § 56 et seq.
• Cal. Civ. Code § 56.05 (definitions of medical information and provider of health care)
• Cal. Civ. Code § 56.06 (businesses deemed providers of health care)
• Cal. Civ. Code § 56.10 (disclosure without authorization; required and permitted disclosures; sale, marketing and immigration enforcement)
• Cal. Civ. Code § 56.101 (confidentiality duty; electronic health record systems)
• Cal. Civ. Code § 56.11 (valid authorization)
• Cal. Civ. Code § 56.13 (further disclosure by a recipient)
• Cal. Civ. Code § 56.35 (patient remedies)
• Cal. Civ. Code § 56.36 (misdemeanor; nominal and actual damages; negligence fine; affirmative defense)
• Cal. Civ. Code § 56.37 (waivers; conditions of care)
• Cal. Civ. Code §§ 56.108, 56.109, 56.110 (named only)
• Cal. Bus. & Prof. Code, div. 2 (§ 500 et seq.)
• Cal. Health & Safety Code, div. 2 (§ 1200 et seq.) and div. 2.5 (§ 1797 et seq.)
• Cal. Ins. Code § 791.02, subd. (k)
• Cal. Fam. Code § 6900 et seq.
• Cal. Health & Safety Code § 123100 et seq. (patient access to records)
• Cal. Health & Safety Code § 1280.15 (breach report and penalties for clinics, health facilities, home health agencies and hospices)
• Cal. Code Regs., tit. 22, §§ 79901, 79902 (breach definitions and reporting)
• Cal. Civ. Code § 1798.82 (data breach notice)
• SB 446 (2025-2026), Stats. 2025, ch. 319; Cal. Civ. Code § 1798.82
• Health Insurance Portability and Accountability Act, 42 U.S.C. § 1320d et seq.
• Health Information Technology for Economic and Clinical Health Act, Pub. L. 111-5, § 13402(f)
• 42 U.S.C. § 17921(5) (definition of electronic health record)
• J.M. v. Illuminate Education, Inc. (2026) 19 Cal.5th 705
• AB 1979 (2025-2026), Stats. 2026, ch. 854 (health care chatbot business deemed a provider from January 1, 2027)