Medical information.

Existing law requires a clinic, health facility, home health agency, or hospice to prevent unlawful or unauthorized access to, and use or disclosure of, patients' medical information, as defined. Existing law requires the clinic, health facility, home health agency, or hospice to report any unlawful or unauthorized access to, or use or disclosure of, a patient's medical information to the State Department of Public Health and to the affected patient or the patient's representative no later than 5 business days after the unlawful or unauthorized access, use, or disclosure has been detected. Existing law requires that the report to the patient or the patient's representative be made to that person's last known address. Existing law requires these entities to delay the report for specified law enforcement purposes and requires that the delayed report be submitted within 5 days of the end of the delay. Existing law authorizes the State Department of Public Health to assess administrative penalties for violation of these provisions and gives the department discretion to consider all factors when determining the amount of a penalty. This bill would instead require those entities to make those reports no later than 15 business days after the unlawful or unauthorized access, use, or disclosure has been detected and would authorize the report made to the patient or the patient's representative to be made by alternative means, including email, as specified. The bill would also require a delayed report for law enforcement purposes to be made within 15 business days of the end of the delay. The bill would give the department full discretion to consider all factors when determining whether to investigate under these provisions.