Skip Navigation LinksAFL-09-38

State of Cal Logo
EDMUND G. BROWN JR.
Governor

State of California—Health and Human Services Agency
California Department of Public Health


AFL 09-38
November 19, 2009


TO:
Acute Psychiatric Hospitals
Alternative Birth Centers
Chronic Dialysis Clinics
Congregate Living Health Facilities
Correctional Treatment Centers
General Acute Care Hospitals
Home Health Agencies
Hospices
Intermediate Care Facilities
Intermediate Care Facilities/Developmentally Disabled
Intermediate Care Facilities/Developmentally Disabled – Habilitative
Intermediate Care Facilities/Developmentally Disabled – Nursing
Primary Care Clinics
Skilled Nursing Facilities
Special Hospitals
Surgical Clinics

SUBJECT:
Reporting of Unauthorized Access or Disclosure of Patient Medical Information

AUTHORITY:  Senate Bill (SB) 337 (Alquist, Chapter 180, Statutes of 2009)

This All Facilities Letter is being sent to inform you of recently chaptered legislation. SB 337 (Alquist, 2009) amended Section 1280.15 of the Health and Safety Code (HSC) with regard to the reporting of unlawful or unauthorized access to, or use or disclosure of, a patient's medical information by specified health care facilities. SB 337 clarifies the existing reporting requirements of "five days" to mean "five business days" and establishes an allowance for health facilities to delay reporting to the affected patient upon request by law enforcement. Effective January 1, 2010, HSC Section 1280.15 (b) requires a clinic, health facility, home health agency, or hospice to report any unlawful or unauthorized access to, or use or disclosure of, a patient's medical information to the department and to the patient or patient's representative, no later than five business days after the unlawful or

unauthorized access, use, or disclosure has been detected by the clinic, health facility, home health agency, or hospice. Additionally, pursuant to Section 1280.15 (c)(1) effective January 1, 2010, a clinic, health facility, home health agency, or hospice shall delay the reporting to the affected

patient or patient's representative of any unlawful or unauthorized access to, or use or disclosure of, a patient's medical information beyond five business days if a law enforcement agency or official provides the clinic, health facility, home health agency, or hospice with a written or oral statement that compliance with the five business day reporting requirement would be likely to impede the law enforcement agency's activities that relate to the unlawful or unauthorized access to, and use or disclosure of, a patient's medical information and specifies a date upon which the delay shall end, not to

exceed 60 days after a written request is made, or 30 days after an oral request is made. A law enforcement agency or official may request an extension of a delay based upon a written declaration that there exists a bona fide, ongoing, significant criminal investigation of serious wrongdoing relating to the unlawful or unauthorized access to, and use or disclosure of, a patient's medical information, that notification of patients will undermine the law enforcement agency's activities, and that specifies a date upon which the delay shall end, not to exceed 60 days after the end of the original delay

period. Facilities are responsible for following all applicable laws. California Department of Public Health's failure to expressly notify facilities of legislative changes does not relieve facilities of their responsibility for following all laws and regulations. Facilities should refer to the full text of SB 337 and HSC Section 1280.15 to ensure compliance.

 

Sincerely,

Original Signed by Kathleen Billingsley, R.N.

Kathleen Billingsley, R.N.
Deputy Director
Center for Health Care Quality

Page Last Updated :