Circumstances for Provider Disclosure of Medical Information – Cal. Civ. Code § 56.10

A provider may disclose medical information under the following circumstances:

1. To providers, health care service plans, contractors or other health care professionals for diagnosis or treatment of a patient.
2. To an insurer, employer, health care service plan, hospital service plan, employee service plan, or any other person or entity responsible for paying for the health care of the services rendered to a patient.
3. To a person/entity responsible for providing billing or claims management, medical data processing or other administrative functions.
4. To agents of professional societies or medical staff at hospitals, professional standards review organizations, or to persons responsible for or defending professional liability that a provider may incur, if the staff is reviewing the competence or qualifications of the health care professionals with respect to medical necessity, quality of care or level of care.
5. For review by a private/public body responsible for licensing or accrediting the provider or health service provider.
6. To the office of the county coroner for all purposes not laid out in previous sections.
7. To public agencies, clinical investigators, health care research organizations, accredited public or private educational institutions, or health care institutions for bona fide research purposes.
8. Medical information created as a result of employment related health services on behalf of the employee may be disclosed to the employer.  Information that may be disclosed includes:
   • Relevant to a lawsuit to which employer and employee are parties and where medical history or conditions are an issue;
   • A description of the functional limitations of the patient.
9. Medical information can be disclosed to insurance company, group administrator.
10. Medical information can be disclosed to health service plan providers that contract with the health service plans to administer the health care service plan.
11. Information relevant to a patient’s care, treatment and condition can be disclosed to probate court.
12. To an organ procurement organization or tissue bank.
13. Can be disclosed if specifically authorized by law, including voluntary reporting to FDA of adverse effects of drugs or medical devices.
14. Basic information (patient’s name, age, city of residence, sex) may be released to a state or federally recognized disaster relief organization.
15. To a third party for encryption or encoding.
16. Can disclose medical information for the purposes of disease management programs and services.
17. To local health departments (as permitted by law) for preventing or controlling disease, injury or disability.
18. Information can be disclosed in accordance with the standards of a psychotherapist, if disclosure is necessary to prevent serious or imminent threat to safety.
19. Information can be disclosed to an employee welfare benefit plan to determine eligibility, coordinate benefits, or to allow the benefit plan or contracting entity to advocate of behalf of the patient; the request must be accompanied by a written authorization for release of information and be consistent with HIPAA standards.

Unless expressly authorized by law, the provider cannot intentionally share, sell, use for marketing, or otherwise use medical information for something that is not necessary to provide treatment to a patient.  The medical information that is disclosed based on this section cannot be further disclosed by any contractors or corporations or affiliates.