HIPAA Privacy and California Confidentiality Laws

Protects the privacy of patients' health information under the HIPAA Privacy Rule and California's Confidentiality of Medical Information Act, which is often stricter. Sets out when information may and may not be shared (including with family, for abuse reports, with CDPH and for immigration enforcement), what a valid California authorization must look like, the Notice of Privacy Practices, patients' privacy rights, safeguards in the home and the field, business associates, and privacy complaints.

Preview: full text with a package

About this policy

Policy number: CA-HSP-PRV-01
Version: 1.0
Main rule: 45 CFR Part 164, Subpart E
Library: California hospice · 60 policies
Category: Privacy
Sections: 25

In short

Look at a patient's record only when your work needs it. Looking out of curiosity is a privacy breach.
You may share information with family or friends involved in the patient's care, unless the patient says no. Ask the patient when you can.
Talk about patients only where others cannot hear you.
Send records to a lawyer, insurer or anyone outside the care team only with a signed authorization or the privacy official's approval.
Give any subpoena, police or immigration request to the Administrator or privacy official (Lee Sample) right away. Do not share information yourself.

What's inside

25 sections. The full text comes with the One-time Policy Pack.

Full text with a package

Terms of Reference
1. Purpose
2. Scope
3. Definitions
4. Policy Statement (45 CFR Part 164, Subpart E; Civil Code §56.10)
5. The Laws This Policy Covers (22 CCR §74880(d)(4)(E)(iv)-(v))
6. When Information May Be Used or Shared
6.1 Care, payment and Agency operations
6.2 Family, friends and caregivers
6.3 Disclosures the law requires or allows without authorization
6.4 Immigration enforcement (Civil Code §56.10(f))
6.5 Authorizations (45 CFR §164.508; Civil Code §56.11)
6.6 Photographs, recordings, media and social media
6.7 Specially protected information
7. Notice of Privacy Practices and Patients' Privacy Rights
8. Safeguards in the Home and in the Field
9. Workforce Duties and Business Associates
10. Privacy Complaints
11. Responsibilities
12. Records and Compliance Monitoring
13. Staff Training
14. References
15. Related Policies and Forms
16. Approval
17. Revision History

An inspector may ask

Who is your privacy official, and how do staff reach that person?
Show me the Notice of Privacy Practices you give patients and the acknowledgment for this patient.

California hospice

Get it for your agency

All 60 California hospice policies, filled in with your details, in Word and PDF.

$1,100one-time · Policy Pack, required

The files are yours to keep. Includes 90 days in the portal with Premium; keep it after that for $109 a month or $1,090 a year.

Buy the Policy Pack See pricing

Rules it follows

45 CFR Part 164, Subpart ECal. Civ. Code §56 et seq.Cal. Civ. Code §56.05Cal. Civ. Code §56.10Cal. Civ. Code §56.11Cal. Civ. Code §56.101Cal. Health & Safety Code §1280.15(a)22 CCR §74880(d)(4)(E)(iv)-(v)22 CCR §74888(g)-(h)22 CCR §74896(l)22 CCR §74884(b)(12)22 CCR §74800(a)(9)45 CFR §164.50245 CFR §164.50845 CFR §164.51045 CFR §164.51245 CFR §164.52045 CFR §164.52845 CFR §164.53042 CFR Part 2, Subpart A42 CFR §418.52(c)(5)

Forms included

CA-HSP-PRV-01-A Notice of Privacy Practices
CA-HSP-PRV-01-B Authorization to Use or Disclose Health Information

Read a sample in full

Guides on this topic

See Cura Core with your agency's name on it.

Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.

Get started Sign in