California Confidentiality of Medical Information Act (CMIA)

More and more frequently, hospitals and other healthcare entities are reported for alleged privacy violations. Many patients and health plan customers don’t know immediately how these privacy breaches impact them, though for most individuals, it can be quite damaging to future privacy.

The Lyon Firm is reviewing the California Confidentiality of Medical Information Act (CMIA) for plaintiffs and accepting class action health privacy claims nationwide.

Our medical information and medical history should be kept private at all costs, which is why California has gone above and beyond federal regulations and adopted comprehensive protections for consumers and patients–a necessary safeguard against breaches of doctor-patient confidentiality and widespread personal privacy violations.

Because medical providers, health care companies, and third-party vendors are often careless with regard to data security, medical information is compromised, leaving individuals vulnerable to medical identity theft.

But are there consumer protections in place? Yes, and individuals can take legal action.

Does HIPAA Take Precedence over CMIA?

The Health Insurance Portability and Accountability Act (HIPAA) is meant to protect patient health information at the federal level, and the California Confidentiality of Medical Information Act (CMIA) takes the protections even more seriously. The California law states that when medical information has been improperly disseminated, individuals can initiate lawsuits and seek compensatory damages.

If you believe your personal medical information has been used without your consent and in violation of HIPAA or CMIA, you may be able to hold those responsible accountable. The Lyon Firm attorneys offer no-cost and confidential consultations regarding California confidentiality laws.

How Does the CMIA differ from HIPAA?

The Confidentiality of Medical Information Act (CMIA) is a California law that protects the privacy of individually identifiable medical information obtained by health care providers, health insurers, and their contractors.  

In short, the CMIA prohibits health care providers from disclosing sensitive medical information without first obtaining authorization, and requires health care providers that collect and store medical information to do so in a properly secure manner.

Under the new California confidentiality laws (CMIA), “medical information” is defined as any individually identifiable information in possession of or derived from “a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment.”

CMIA’s reach goes beyond medical professionals and doctor-patient confidentiality – the medical privacy act statute also allows individuals to seek compensation when any “person or entity” uses medical information “knowingly or willfully,” and “for the purpose of financial gain.”

What Personal Information is Protected under CMIA?

CMIA defines “medical information” as any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment.

“Individually identifiable information” may include the following:

• Patient’s name
• Address
• Electronic mail address
• Telephone number
• Social Security number
• Health Insurance information
• Financial information
• Treatment information
• Prescriptions

What are the CMIA Authorization Requirements?

• Authorization must be either handwritten by the individual who signs the document (the patient or their representative), or printed in a minimum of 14-point type
• Authorization language must be clearly separated from any other language on the same page
• Patient’s signature must “serve no other purpose than to execute the authorization”
• Authorization form must be signed and dated
• Authorization must include specific uses and limitations on the types of medical information to be disclosed
• Authorization must include the name or functions of the health care provider, health care service plan pharmaceutical company, or contractor that is being allowed to disclose the information pursuant to the authorization, as well as the names or functions of those persons or entities authorized to receive the information

Can someone access my medical records without my permission?

No, and individual plaintiffs may bring an action against any person or entity that has negligently released confidential information or records, for the amount of actual damages.

Any healthcare provider who knowingly and willfully obtains, discloses, or uses medical information in violation of CMIA may be liable for an administrative fine of up to $2,500 per medical privacy act violation.