Health care information.

Existing law, the Confidentiality of Medical Information Act (CMIA) , prohibits a health care provider, a contractor, or a health care service plan from disclosing medical information, as defined, regarding a patient of the provider or an enrollee or subscriber of the health care service plan without first obtaining an authorization, except as specified. In addition to other remedies available, existing law authorizes an individual to bring an action against any person or entity who has negligently released his or her confidential records in violation of those provisions for nominal damages of $1,000. This bill would specify that, in an action brought on or after January 1, 2013, a court may not award nominal damages if the defendant establishes specified factors as an affirmative defense, including, but not limited to, that it is a covered entity or business associate, as defined, that it has complied with any obligations to notify persons entitled to receive notice regarding the release of the information, and that it has taken appropriate preventative actions to protect the confidential information or records against release consistent with federal law, as specified. The bill would provide that if an affirmative defense is established as described above, the defendant shall not be liable for more than one judgment on the merits for releases of confidential information or records arising out of the same event, transaction, or occurrence.