Privacy of Medical Information: HIPAA and the Confidentiality of Medical Information Act
Sets out how the Agency protects patients’ medical information under the California Confidentiality of Medical Information Act (Cal. Civ. Code §56 et seq.), the duty of every licensed home health agency to prevent unlawful or unauthorized access, use, or disclosure (Cal. Health & Safety Code §1280.15(a)), and the HIPAA Privacy Rule: the privacy official, minimum necessary use, when information may be shared without an authorization, what a valid authorization must contain (including the California 14-point type rule), the notice of privacy practices, patients’ privacy rights, business associates, conduct in the home, sanctions, and training.
- Policy number
- CA-HH-PRV-01
- Version
- 1.0
- Main rule
- Cal. Civ. Code §56.10
- Library
- California home health · 58 policies
- Category
- Privacy
- Sections
- 21
In short
- Look only at the records of patients you care for. Every view is logged.
- Share only what the other person needs. Ask the patient before talking about their care in front of family or visitors.
- Never text patient information from your own phone, and never post about a patient online, even without a name.
- Releases to anyone outside the patient’s care team need a signed authorization unless the privacy official says otherwise.
- Abuse reports are always allowed. Privacy never stops you from reporting abuse.
- Tell the privacy official right away about any misdirected fax or email, or any lost papers.
What's inside
21 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (Cal. Civ. Code §56.10)
- 5. Everyday Rules for Staff
- 6. When Information May Be Shared Without an Authorization
- 7. Family Members and Friends
- 8. Authorizations
- 9. Uses That Are Never Allowed Without Express Permission
- 10. Notice of Privacy Practices
- 11. Patients’ Privacy Rights
- 12. Business Associates
- 13. Complaints, Sanctions, and Mitigation
- 14. Responsibilities
- 15. Records and Compliance Monitoring
- 16. Staff Training
- 17. References
- 18. Related Policies and Forms
- 19. Approval
- 20. Revision History
An inspector may ask
- Who is your privacy official? Show me your notice of privacy practices and how you document that each patient received it.
- Show me a signed authorization for release of medical information. Does it meet California’s requirements?
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.