Medical records: confidentiality.

The Confidentiality of Medical Information Act requires that every provider of health care, health care service plan, pharmaceutical company, and contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical records do so in a manner that preserves the confidentiality of the information contained in the records, and provides that negligence in conducting these activities may result in damages or an administrative fine or civil penalty, as specified. Existing law also makes a violation of these provision that results in economic loss or personal injury to a patient punishable as a misdemeanor. This bill would require a health care provider, health care service plan, or contractor, if there is a breach in the security of a patient's social security number, driver's license number, California identification card number, or financial information and that provider, plan, or contractor is required to issue a breach notification, to offer, in the breach notification, one year of free credit monitoring services to the patient. Because a violation of this requirement that results in economic loss or personal injury to a patient would be punishable as a crime, this bill would impose a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.