Source: http://www.docstoc.com/docs/47605458/This-document-is-a-work-in-progress-and-is
Timestamp: 2014-03-13 18:17:05
Document Index: 378666271

Matched Legal Cases: ['art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'Art. 1', 'art 4', 'art 4', 'art 2', 'art 2']

This document is a work in progress and is
Privacy Committee - Baseline Framework
This document is a work in progress and is intended for the sole use of members of the California Privacy and Security Adviso ry Board (CalPSAB) and committees. Direct your questions concerning any other
use of the document to the Office of HIPAA Implementation.
Sub-                                                                                                                                                                                     Principle
Description                                               Policy Requirements                                       Source           Preemption
Category                                                                                                                                                                                  Categories
CA State Law - Preemption
Especially protected mental information that may only be released
with a signed written request, that includes specific data elements,
5. Use Limitation,
intended use, for how long information will be kept, information may        CA Civil Code
CMIA - CA Medical Information Act                                                                                                                                      6. Purpose
not be used for other purposes outside what’s specified on the              56.104
written request, data will be destroyed or returned to originator after
time specified on the request.
No preemption for IPA except 1798.18 Part. P records accuracy,
timeliness; 1798.19 Tot. P contracting for record maintenance;
1798.24(d) use of info by govt.,(e) statutory duties, (j) state
archives,(k) court orders,(l) warrants,(n) Part.P payment claims,(p)
investigations,(s) legislature;1798.24a Tot P by 164.502 Use &amp; Disc
&amp; .506 TPO &amp; .508 authorizations for law enforcement; 1798.24b
Part P for investigating cases of abuse/neglect - Labor Code
Privacy Act 5                           Information
IPA - Information Practices Act                    Concessionaire;1798.26 Tot P sales of DMV info; 1798.28 Tot P by
USC Sec 552a                            Quality,
164.528 informing of amendments changes to disclosure receivers;
1798.33 Part.P by 164.524(c)(4) fees for copies; 1798.35 Part.P by
164.526 amendments; 1798.36 Tot.P by 164.530(d) for
disagreement with denials; 1798.37 Tot.P by 164.526(d)
disagreements to recipients of disclosures; 1798.60 &amp; .64 Tot.P by
164.502, .506, &amp; .508 for commercial purposes &amp; DGS storage;
1798.68 Part.P district attorneys;
No preemption for PAHRA except 123110( c) by HIPAA 164.524 x-                                                       2. Health
rays; 123111 all by 164.526 written addendums, addendums with                                                       Information
disclosures, provider liability &amp; violation by provider; 123115(b) by                                               Quality,
PAHRA - Patients Access to Health Records          164.524(a) psychotherapy notes having adverse consequences;                                                         7. Security
Act                                                123130 by 164.524 summary of record to patient. Note: 123149 &amp;                                                      Safeguards
123149.5 deals with electronic record keeping and transmission
(telehealth).
Sub-                                                                                                                                                                    Principle
Description                                        Policy Requirements                                       Source           Preemption
Category                                                                                                                                                                 Categories
No Preemption for Welfare &amp; Institutions Code 5328, except Partial           CA Wel &amp; Inst                      3. Individual
LPS - Lanterman, Petris, and Short Act     P for (r) psychotherapist believes harm to self or others; Total P for       Code 5328B                         Participation,
Confidentiality Provisions                 5328.06 protection &amp; advocacy; Total P 5328.4 law enforcement.                                                  7. Safety
IIHI - Individually Identifiable Health Information -                        Compare with the                   2. Health
Individually Identifiable Health Information (IIHI) is information that is   CMIA Civil Code                    Information
a subset of health information, including demographic information            56.01 definition of                Quality,
collected from an individual that:                                           medical                            3. Individual
Is created or received by a health care provider, health plan,               information                        Participation,
employer, or health care clearinghouse, and                                                                     4. Collection
Relates to:                                                                                                     Limitation,
1. The past, present, or future physical or mental health condition                                             5. Use Limitation,
of an individual,                                                                                           6. Purpose
2. The provision of health care to an individual, or                                                            Limitation,
3. The past, present, or future payment or the provision of payment                                             7. Security
of health care to an individual, and                                                                        Safeguards,
4. Identifies the individual, or
5. Has a basis to believe the information can be used to identify the
individual. [45 C.F.R. &#167; 160.103 (definition of individually
identifiable health information)]
National security                          HIPAA allows collection of PHI by national security, intelligence and        HIPAA 45 CFR                       4. Collection
presidential protection services                                             &#167;164.512(k)(2)                     Limitation
FDA regulated product or safety activity   May collect or report certain data                                           CA Civil Code                      4. Collection
56.10 c14                          Limitation
HIPAA 45 CFR
164.512 b1
Sub-                                                                                                                                                 Principle
Description                          Policy Requirements                                  Source          Preemption
Category                                                                                                                                              Categories
Millitary / VA                 Departments of Defense or Transportation may collect and disclose      HIPAA 45 CFR                      4. Collection
to the Department of Veterans Affairs the medical information of a     &#167;164.512(k)(1)(ii)                Limitation,
member of the Armed Forces upon separation or discharge from                                             5. Use Limitation
military service for the purpose of determining eligibility for or
entitlement to veterans’ benefits
OSHA                           May collect or report certain medical information                                                        4. Collection
CLIA                           Laboratory data disclosing test results must go to the provider, not                                     5. Use Limitation,
direct to the consumer. Unless the consumer ordered the test. CA                                         3. Individual
law about electronic transmission of the test results (HIV) find                                         Participation
FERPA                          Education related
Description                                              Policy Requirements                                    Source       Preemption    Categories
Collection of information, i.e., individually     HIPAA does not impose requirements on the collection of health             IPA Civil Code                 4. Collection
identifiable health information (IIHI), (shall,   information.                                                               section 1798.15                Limitation, 3.
should, may) be necessary;                        IPA Civil Code Section 1798.15 - as practicable directly from                                             Individual
individual; only applies to state agencies.                                                               Participation
Note: the IPA applies to State Government Agencies only.
Consent (shall, should, may) be obtained or       IPA Civil Code Section 1798.16 - maintain the source of the info     IPA Civil Code                       6. Purpose
collection (shall, should, may) be authorized     collected.                                                           Section 1798.16                      Limitation
by or under law;                                  Need to include JCAHO in this analysis for hospitals since JCAHO has
some specific consent requirements, e.g. photos.
Individuals (shall, should, may) be fully         HIPAA requires notice.                                                     HIPAA – 45 CFR                 3. Individual
informed of the collection.                       IPA Civil Code Section 1798.17 - Agency shall provide notice when          section 164.524                Participation
collecting info, does not apply to law enforcement &amp; must conform with     IPA Civil Code
Federal Privacy Act of 1974 (Public Law 93-579)                            Section 1798.17
Limiting      Information collection (shall, should, may) be    HIPAA requires that covered entities requesting PHI limit their request                                   6. Purpose
Collection by   limited to and required for only the identified   to the minimum necessary for the purpose for which the data is being                                      Limitation
Purpose       purpose;                                          collected
Purpose of collection (shall, should, may) be     HIPAA requires that such practices be generally described in the           HIPAA - 45 CFR                 6. Purpose
clear at or before time of collection;            covered entity&#39;s notice of privacy practices. If not properly described,   Section 164.520                Limitation
use for the purpose is not permitted. How does this relationship
impact the exchange between data providers and data consumers?
For example, mandated public health reporting vs. permissible public
Information (shall, should, may) be collected     Not a HIPAA requirement                                                                                   6. Purpose
by fair and lawful means.                                                                                                                                   Limitation
Minimum        Collection (shall, should, may) be limited to     Not a HIPAA requirement                                                                                   6. Purpose
Necessary       the minimum amount of data necessary to                                                                                                                     Limitation
By Purpose      achieve the purpose for which the collection      IPA - Maintain records on info necessary to accomplish purpose.            IPA Civil Code
is being done. This applies to identifiers of a                                                                              Section 1798.14
person as well as any other health
Description                                              Policy Requirements                                   Source          Preemption    Categories
information about that person.
The assignment of a subject&#39;s identifier to     Identifier here should be broadly interpreted under HIPAA to include,     HIPAA - 45 CFR                    6. Purpose
the data being collected (shall, should, may)   at a minimum, the 18 facial identifiers called out in the privacy rule.   Section 164.514(b)                Limitation
be done only when necessary and allowed
and in accordance with prescribed
Description                                                 Policy Requirements                                       Source         Preemption    Categories
Use of information (shall, should, may) be       Use of information shall be necessary;                                          HIPAA - 45 CFR                   5. Use
necessary;                                       CMIA Civil Code Section 56.16 - Does not prohibit general acute care            section 164.509 &amp;                Limitation
provider from releasing info. (as defined) except as defined in Civil Code      164.512
Disclosure of information (shall, should, may)   section 56.05( c)
be necessary;                                    CMIA Civil Code Section 56.26 - Admin staff of programs that provide            CMIA Civil Code
Payment                                          payment for health care services shall restrict use/disclosure to that          section 56.16
necessary for the administration of the program, or as required by law, or
with authorization.                                                             CMIA Civil Code
HIPAA permits disclosures of PHI for certain purposes and under certain         section 56.26
CMIA Civil Code sections 56.10 (a) &amp; (b) (1 - 9) covers required disclosures,
[check 2007 updates]
CMIA Civil Code section 56.10( c) covers permitted disclosures, (1-19)
which includes purposes of disease management and exceptions.
CMIA Civil Code section 56.16 - Does not prohibit general acute care
provider from releasing info. (as defined) except as defined in Civil Code
section 56.05 ( c)
CMIA Civil Code section 56.21 - Valid authorization – defined
CMIA Civil Code section 56.23 - Employer shall communicate to receiver of
info based on an authorization, any limitations.
CMIA Civil Code section 56.245 - Recipient of info based on an
authorization may not further disclose.
IPA Civil Code section 1798.20- Rules of conduct
IPA Civil Code section 1798.23 - DOJ shall review every 5 yrs. to determine
if exemption should continue.
Description                                                 Policy Requirements                                     Source          Preemption    Categories
For certain uses, individual consent or           HIPAA does not require consent for certain purposes but requires              HIPAA 45 CFR                      3. Individual
authorization (shall, should, may) be             authorization for USE of PHI in a number of instances                         sections 164.502 &amp;                Participation
required or such use (shall, should, may) be      CMIA Civil Code section 56.11Various aspects of authorization                 164.512
authorized by or under law.                       CMIA Civil Code section 56.20 Establish appropriate procedures to protect     CMIA Civil Code
For certain disclosures, consent or               (includes required authorization, no discrimination if employee refuses to    section 56.11
authorization (shall, should, may) be required    sign authorization under 56.11 and restrictions on disclosures.               CMIA Civil Code
or disclosure (shall, should, may) be             CMIA Civil Code section 56.21 - Valid authorization - defined                 section 56.20
authorized by or under law                                                                                                      CMIA Civil Code
CMIA Civil Code section 56.22 - upon demand provide copy of authorization
Research &amp; Quality improvement                    to patient                                                                    section 56.21
[description of provider needs to be more                                                                                       CMIA Civil Code
HIPAA requires authorization for DISCLOSURE of PHI in a number of
specific]                                                                                                                       section 56.22
Evidence code should be released to                                                                                             Evid. Code
For Research, IRB approval is needed for disclosure.
patient&#39;s attorney                                                                                                              section 1158
CMIA Civil Code section 56.11 - Various aspects of Authorizations
Civil Code section CMIA 56.102 Pharmaceutical companies may not               CMIA Civil Code
disclosure without authorization.                                             sections 56.11,
CMIA Civil Code section 56.26 - Admin staff of programs that provide          56.102
payment for healthcare services shall restrict use/disclosure to that         CMIA Civil Code
necessary for the administration of the program, or as required by law, or    section 56.26
with authorization (exception Insurance Info Privacy Act. CMIA Civil Code     CMIA Civil Code
section 56.105 - Release for Provider Liability)                              section 56.105
Permitted   Information use (shall, should, may) be           HIPAA limits the use of PHI by covered entities to a set of permitted         HIPAA 45 CFR                      5. Use
Uses      limited to and required for only the identified   purpose for which the data may be used                                        sections 164.502 &amp;                Limitation
purpose                                           CMIA Civil Code section 56.13 - No redisclosureHIPAA limits the use of PHI    164.512
Information disclosure (shall, should,            by covered entities to a set of permitted purpose for which the data may be   CMIA Civil Code
may) be limited to and required for only          used. Any disclosure must be limited to the information necessary to carry    section 56.13
the identified purpose                            out the purpose of the disclosure.
42 CFR Part 2: Any disclosure must be authorized
CMIA CA Civil Code section 56.13 - No redisclosure
CMIA CA Civil Code section 56.14 - Provider shall communicate any
limitations regarding use of information
IPA CA Civil Code section 1798.24 (f) governmental entity, (g) Public
Description                                               Policy Requirements                                         Source         Preemption      Categories
Records Act (Government Code sections 6250-6270), (h) research, (i)
health &amp; safetyRegarding the use of the information
Use (shall, should, may) not be conditioned   HIPAA requires authorization for USE of PHI in a number of instances              HIPAA 45 CFR                        3. Individual
on patient consent or authorization                                                                                             164.512                             Participation
HIPAA does not require consent for treatment, operations or payment but
Disclosure (shall, should, may) or not be     requires authorization for DISCLOSURE of PHI in a number of instances.
conditioned on patient consent or             Consent is required for certain sensitive info to be disclosed. CA law [ site ]
authorization.                                does require a consent to disclose info to payer for HIV info.
42 CFR Part 2: Federally funded alcohol and drug abuse treatment program
can not disclose identified patient recommendation
Pharmaceutical company may not require a patient, as a condition of
receiving pharmaceutical, to sign authorization/release/consent or waiver
permitting disclosure.
Permitted uses for treatment, payment and health care operations without          Requirement          Part. P of
the need for a patient consent or authorization for such uses and                 HIPAA 45 CFR         IPA CA Civil
disclosures                                                                       sections 164.502 &amp;   Code
IPA CA Civil Code section 1798.24(n) Agencies paying claims, except               164.506              section
psychotherapy notesPermitted disclosure for treatment, payment and health         IPA CA Civil Code    1798.24(n)
care operations without the need for a patient consent or authorization of        section 1798.24(n)   by 45 CFR
such uses and disclosures                                                                              section
CMIA CA Civil Code section 56.10(c)(2) Release permitted for treatment or                              164.508
payment.                                                                                               (a)(2)
CMIA CA Civil Code section 56.10( c)(4)(5) Release permitted for some
Permitted uses for certain situations in which the patient needs to be            Requirement
afforded an opportunity to agree or object (provider directories, to those        HIPAA 45 CFR
involved in individual’s care and for notification purposes).                     section 164.510
45 CFR section 164.510 in the context of HIE is very limited. Patient must
be present/available or the disclosure must be made based on the                  CMIA CA Civil
professional judgment of the covered entity.                                      Code sections
CMIA CA Civil Code section 56.16 - Does not prohibit general acute care           56.16, 56.05( c),
Description                                                Policy Requirements                                        Source          Preemption   Categories
provider from releasing info. (as defined) except as defined in CA Civil Code    56.10( c)(5),
section 56.05 ( c)                                                               CA Civil Code
CMIA is silent on disclosures to family and those involved in the care of the    section 56.1007( c)
CMIA CA Civil Code section 56.10( c)(5) allows disclosure to state or
federally recognized disaster relief org for responding to welfare inquires
Civil code section 56.1007(C) mirrors HIPAA provision for relief to disaster
Permitted disclosure for certain situations in which the patient needs to be
afforded an opportunity to agree or object (provider directories, to those
involved in individual’s care and for notification purposes)
This section crosses over [CMIA CA Civil       Permitted uses for certain situations for which the patient MUST first           Requirement
Code section 56.17(g) to                       authorize such uses and disclosures (marketing, psychotherapy notes), and        HIPAA 45 CFR
Authorizations, CA Civil Code section 56.11]   the form and manner in which such authorization must be achieved                 section 164.502
CMIA CA Civil Code section 56.104 - Outpatient Psychotherapy records             CMIA CA Civil
CMIA CA Civil Code section 56.17 - Genetic Info. release by healthcare           Code section
service planPermitted disclosure for certain situations for which the patient    56.104
MUST first authorize such uses and disclosures (marketing, psychotherapy         CMIA CA Civil
notes), and the form and manner in which such authorization must be              Code section 56.17
CMIA CA Civil Code section 56.104 - Psychotherapy records
CMIA CA Civil Code section 56.17 - Genetic Info.
CMIA CA Civil Code section 56.265 - Insurers shall not disclose IIHI to
affiliate or third party for use to grant credit.
CMIA CA Civil Code section 56.27 - Employers that are in insurance Info &amp;
Privacy Protection Act Article 6.6, Section 791 of Part 2 of Division 1 of the
Insurance Code, shall not be deemed to have violated CA Civil Code
section 56.20 by disclosing medical info gathered in connection with an
Description                                                 Policy Requirements                                         Source         Preemption    Categories
Section 1798 of Civil Code                      Permitted uses for certain situations in which the entity does not have to        Requirement
obtain a patient authorization, or give the patient the opportunity to agree or   HIPAA 45 CFR
object, such as public health                                                     section 164.510
CMIA CA Civil Code section 56.10 ( c) covers permitted disclosures, (1-19)        CMIA CA Civil
which includes purposes of disease management and exceptions.                     Code section
Patient must be present/available or the disclosure must be made based on        56.10(c)
the professional judgment of the covered entity.&quot;                                 Title 17 CCR, Code
Permitted disclosure for certain situations in which the entity does not have     of CA Health &amp;
to obtain a patient authorization, or give the patient the opportunity to agree   Safety - numerous
or object [numerous reporting regulations]                                        reporting
Minimum        Information being used (shall, should, may)     Minimum necessary applies to ALL uses except:                                     HIPAA 45 CFR                      5. Use
Necessary by   be limited to the minimum necessary             1) when done by a provider for treatment purposes;                                section 164.502(b)                Limitation
Purpose        amount to achieve the purpose for the use.      2) to the individual subject of the information;
This applies to identifiers of a person as
3) when done pursuant an authorization from an individual;
well as any other health information about
that person.                                    4) when done as part of the compliance with HIPPA
Disclosure (shall, should, may) be limited to   Minimum necessary applies to ALL uses and disclosures except
the minimum amount of information               1) when done by a provider for treatment purposes;
necessary to achieve the purpose for which      2) to the individual subject of the information;
the disclosure is being made. This applies to   3) when done pursuant an authorization from an individual;
identifiers of a person as well as any other    4) when done as part of the compliance with HIPAA TCS;
health information about that person.This       5) when done to HHS for HIPAA enforcement purposes;
section crosses over [CMIA CA Civil Code
section 56.17(g) to Authorizations, CA Civil    6) when required by other law.CMIA CA Civil Code section 56.104 -
Code section 56.11]                             Psychotherapy records CMIA CA Civil Code section 56.17 - Genetic Info.
Description                                               Policy Requirements                                  Source   Preemption    Categories
Cross-Policy   Disclosure (shall, should, may) be permitted   HIPAA does not impose cross-policy domain controls; HIPAA DOES require                                3. Individual
Domain Data    if it has been ascertained that recipient is   certain disclosures to be done with individual&#39;s authorization, regardless of                         Participation
Flows          subject to comparable information privacy      whether the recipient has a reasonably comparable privacy scheme or not
Disclosure is with individual’s consent; or
Disclosure is necessary by contract at the
request of, or to benefit of the individual
Sub-          Description                                 Policy Requirements                                                             Source              Preemption      Categories
Individual (shall, should, may) have the    HIPAA does not require consent for use and disclosure (as above) for            HIPAA 45 CFR                        3. Individual
right to control collection, use and        treatment, operations or payment.                                               section 164.508                     Participation
disclosure of PHI as established by law     HIPAA requires authorizations for other enumerated uses and disclosures.        42 CFR Part 2
or regulation.                              42 CFR Part 2: Federally funded alcohol and drug abuse treatment program
There are three forms of consent:           can not disclose identified patient records without patient&#39;s consent.
deemed, implied or active.                  Consent for treatment is not a subject of this framework
Deemed consent is determined by
jurisdictional law or regulation
CMIA - disclosure of medical info regarding a patient subject to CA Civil       CMIA CA Civil
authorizing collection, use or disclosure
Code section 1798.24 made only with a compliant authorization.                  Code section
without active individual consent, e.g.,
disclosures for public health.              IPA CA Civil Code section (b) disclosure of personal info needs prior written   6.29(b)
voluntary consent of individual (within 30 days or time specified)              IPA CA Civil
Implied consent is an opt-out option in
which an individual must actively refuse    LPS Welfare and Institutions Code Welfare and Institutions - Consent for        Code section
collection, use and disclosure of PHI.      each separate use                                                               1798.24 (b)
Active consent is when the individual                                                                                       LPS Welfare and
must provide authorization before the                                                                                       Institutions Code
collection, use and disclosure of PHI                                                                                       section 5328.7
Easy to Use   Forms authorizing consent shall be in       HIPAA requires plain language –                                                 HIPAA 45 CFR                        3. Individual
and           plain language that explains the            IPA - Agencies may establish reasonable fees for copies - shall be in plain     section                             Participation
Understand    individual&#39;s options and purpose of                                                                                         164.520(b)
consent                                     PAHRA Health and Safety Code section 123148 Test results to be in plain         IPA CA Civil        IPA CA Civil
language                                                                        Code section        Code section
IPA CA Civil Code section 1798.34 (c ) - plain language                         1798.34             1798.34c per
PAHRA Health        45 CFR
and Safety Code     164.512(a)(1)
section 123148(a)
IPA CA Civil
1798.34c
Sub-            Description                                   Policy Requirements                                                             Source              Preemption   Categories
Consistent      Consent for collection, use and               HIPAA requires that uses and disclosures requirements do not interfere with     HIPAA - 45 CFR                   3. Individual
with Quality    disclosure requirements shall not             providing medically necessary care                                              section                          Participation,
Care            create barriers to providing medically                                                                                        164.506(b)                       5. Use
CMIA - Provider may not require a patient to sign an
necessary care but be part of the             authorization/release/consent/waiver as a condition of treatment. Any such      CA Civil Code                    Limitation
normal process of quality care delivery.      waiver deemed unenforceable.                                                    section 56.37
CMIA CA Civil Code section 56.25 - Employer shall not disclose info             CMIA CA Civil
connected to providing health care benefits                                     Code section
56.25 (a)(b)( c)
Respectful of   Social, cultural, literacy, religious needs   Not a HIPAA requirement                                                                                          3. Individual
Individual                                                                                                                                                                    Participation
Medical conditions                            Not a HIPAA requirement                                                                                          3. Individual
Individual&#39;s sensitive information            HIPAA requirements on psychotherapy notes                                       CMIA CA Civil                    5. Use
needs                                         CMIA CA Civil Code section 56.104 - Psychotherapy records                       Code section                     Limitation
CMIA CA Civil Code section 56.17 - Genetic Information                          56.104
Welfare and Institutions Code section 5328 - All info obtained in providing     CMIA CA Civil
services under Div.4, 4.1, 4.5, 5, 6, or 7 to be kept confidential              Code section
Welfare and Institutions Code section 5328.15 - Safeguard confidential
information                                                                     Welfare and
PAHRA Health and Safety Code section 123125(a) - Shall not require
section 5328 &amp;
provider to permit inspection /copies of alcohol &amp; drug abuse records
prohibited by Sec. 408 of federal Drug Abuse Office &amp; Treatment Act of 1972
(Public Law 92-255) or Section 333 of federal Comprehensive Alcohol Abuse       PAHRA Health
&amp; Alcoholism Prevention, Treatment, &amp; Rehabilitation Act of 1970 (public Law    and Safety Code
91-616)                                                                         section 123125
PAHRA Health and Safety Code section 123110 &amp; 123115 - minor&#39;s records,         PAHRA Health
mental health records, written record, other provider inspection, refusal for   and Safety Code
access.                                                                         section 123115(b)
Part.P with 45
CFR 164.524(a)
Sub-       Description        Policy Requirements                                                            Source             Preemption   Categories
Other              Not a HIPAA requirement
Minors             Minors control access to the medical information concerting treatment for      PAHRA CA                        3. Individual
which they have a legal right to give consent. CA Health &amp; Safety Code         Health &amp; Safety                 Participation
sections 123110 (a), 123115a. HIPAA 45 CFR &amp; 164.502g                          Code sections
123110 (a) &amp;,
HIPAA 45 CFR &amp;
164.502g
CA Health &amp;
sections 120980,
120775, &amp;
HIV Test Results   HIV- CA requires that HIV test results shall not be disclosed without the      CA Health &amp;                     5. Use
written authorization from the patients.                                       Safety Code                     Limitation,
CA Health &amp; Safety Code sections 120980, 120775, &amp; 120980                      section 123110                  3. Individual
HIV test results may be disclosed to personal representative, for treatments   HIPAA 45 CFR                    Participation
purposes, organ/tissue donationHIV may be disclosed in with a court order      section 164.506
CA Penal Code sections 1202.1 and 1524.1                                       HIPAA 45 CFR
sections 164.512
h, &amp; 164.512 g1
section 7184.5d
section 121010
Sub-         Description                                Policy Requirements                                                                Source              Preemption   Categories
Mental Health                              Mental Health – LPA covers disclosures to third parties of mental health           CA Civil Code                    5. Use
information created at wards, clinics …etc founded by the Broznan-                 section 56.104                   Limitation
McCrquodale Act.
CMIA applies to disclosures that are not covered by LPA Act (generally
private community mental health providers) CMIA provides that no provider
may release information specifically relating to psychotherapists activity.
Psychotherapy Notes                        Psychotherapy Notes may only be used or disclosed with a written                   HIPAA 45 CFR                     5. Use
authorization except, for TPO, by originator, to DHHS or prevent imminent          sections                         Limitation
threat.                                                                            164.501&amp;
Public Health-must disclose in situations of harm to self or others (eminent       164.508
threat) Keep psychotherapy notes separate from medical records, otherwise
not protected by HIPAA.
Drug and Alcohol Abuse                     Regulations restrict the disclosure and use of &quot;patient identifying&quot; information   42 C.F.R. &#167;&#167; 2.34                5. Use
about individuals in substance abuse treatment.                                    and 2.35                         Limitation
Patient-identifying information is information that reveals that a person is
receiving, has received, or has applied for substance abuse treatment
Genetic Testing                            All testing results and personal information from hereditary disorders             Health and Safety                5. Use
programs obtained from any individual, or from specimens from any                  Code &#167;124980j                    Limitation
individual, shall be held confidential and be considered aconfidential medical
Right to   Individuals (shall, should, may) have      General &#39;principle&#39; established by HIPAA                                           HIPAA 45 CFR                     3. Individual
Control    control over whether and how their         PAHRA Health and Safety Code section 123135 - Does not grant greater               section                          Participation
Access by   information is shared.                                                                                                        164.522(a)
access to patient records by any...
PAHRA Health
section 123135
The individual (shall, should, may) have   HIPAA requires that opt-out options be offered, BUT ONLY ON specific types         HIPAA – N/A                      3. Individual
the ability to opt-out in whole or part.   of uses and disclosures (i.e., fundraising)                                                                         Participation
Sub-          Description                                 Policy Requirements                                                               Source             Preemption       Categories
The individual (shall, should, may) be      HIPAA requires authorization for such uses and disclosures                        HIPAA 45 CFR                        3. Individual
able to limit use and disclosure of                                                                                           164.501                             Participation
information for commercial purposes.                                                                                          Definition of
The individual (shall, should, may) have    HIPAA provides for personal representatives, but do not establish the legal       HIPAA 45 CFR                        3. Individual
the revocable right to designate            process by which a personal representative is designated as such by a             164.502(g)                          Participation
someone else to exercise this control.      person/patient                                                                    42 CFR Part 2
42 CFR Part 2: Federally funded alcohol and drug abuse treatment program          IPA CA Civil
can not disclose identified patient records without patient&#39;s consent             Code section
IPA Health and Safety Code section 1798.24(c) authorized representative           1798.24 (c)
(guardians or Personal Representatives)
Revocation   Individuals (shall, should, may) have the   42 CFR Part 2 permits a patient to revoke consent orally                          HIPAA 45 CFR                        3. Individual
right to revoke consent or authorization                                                                                      164.524                             Participation,
to future access.                           HIPAA requires written revocation                                                 42 CFR Part 2                       8.
CMIA CA Civil Code section Nothing construed to prevent person from               CMIA CA Civil                       Accountability
cancelling or modifying an authorization                                          Code sections
PAHRA CA Civil Code section - able to revoke at any time                          56.15 &amp; 56.24
section 123148
Rights of Individuals                       IPA CA Civil Code section 1798.30 - agencies shall adopt regulations or           IPA CA Civil       IPA CA Civil     3. Individual
publish guidelines specifying procedures to implement each of the rights of       Code section       Code section     Participation
individuals set forth in this article.                                            1798.30            1798.34b no P.
IPA CA Civil Code section 1798.34(b) - right of individual or representative to   HIPAA – 45 CFR     per 45 CFR
inspect all personal info &amp; get copies.                                           sections 164.524   164.512(a)(1)
CA Constitution - Article 1, Section 1 entitled to privacy                        &amp; 164.526
1798.34b
Art. 1 Sec 1
Sub-            Description                               Policy Requirements                                                               Source             Preemption        Categories
Access to       Upon request, an individual (shall,       Right to access personal health information for review and/or copy. Note:         HIPAA 45 CFR                         3. Individual
One&#39;s Own       should, may) be informed of the           there are operational details requiring denial of access to certain information   section 164.524                      Participation
Information     existence, use and disclosure of his or   No preemption
By Individual   her personal information and shall be     Civil Code section 56.07 only                                                     45 CFR section
given access to that information.                                                                                           164.512(a)(1)
[by operation of HIPAA provision section 45 CFR 164.512(a)(1)]
Access (shall, should, may) be
(b) A request by a patient pursuant to this section shall not be deemed to be
reasonable, appropriate, convenient,
an authorization by the patient for the release or disclosure of any              CMIA CA Civil
information to any person or entity other than the patient.                       Code section
(c) this section does not apply to patients covered by PAHRA                      56.07
CMIA CA Civil Code section 56.28 Nothing in this part shall affect existing
laws relating to patient right of access or relating to disclosures made
pursuant to Section 1158 of the Evidence Code or its related privileges.          CMIA CA Civil
CMIA CA Civil Code section 56.29(a) Nothing in Chapter 1, Section 1798 on,        Code section 56.
of Title 1.8 of part 4 of Division 3 shall permit acquisition or disclosure of    28
med. information without authorization. Partial preemption Civil Code
subdivision 56.28(a) but not (b) and (c), no corresponding HIPAA provision.
CMIA CA Civil Code section (b) &amp; (c ) with authorization for specified time       CMIA CA Civil
and limitations on information (Chap 1, Sec 1798, Title 1.8 of part 4 of Div 3)   Code section
both preempted by HIPAA.                                                          56.29
PAHRA Health and Safety Code section 123110(a)-(j) right to inspect,              PAHRA Health       PAHRA Health
entitled to copies, x-rays, public assistance, appeals - right to copies,         and Safety Code    and Safety
successful appeals, timing of responses, reasonable verification, provider        section 123110     Code section
liability, provider violation penalties, withholding records                      (a) - (j)          123110(c )
IPA CA Civil Code section 1798.32 - Individuals rights to access                  IPA CA Civil       Tot.P by 45
IPA CA Civil Code section 1798.33 - agencies may establish fees for copies        Code section       CFR section
&amp;1798.34(e) - true copy by mail.                                                  1798.32            164.524
IPA CA Civil Code section 1798.34 - Timeliness of access                          IPA CA Civil       CA Civil Code
IPA CA Civil Code section 1798.34(d) - additional info to access                  Code section       section 1798.32
1798.33            &amp; 45 CFR
IPA CA Civil       section
Code section       164.524(a)(2) &amp;
Sub-       Description                         Policy Requirements                                                              Source              Preemption       Categories
1798.34(a)(d)       (d)(3) [access
No.P both (d) &amp;     to PHI]
45 CFR 164.514      IPA CA Civil
1798.33 Part.P
by 45 CFR
164.524(c )(4)
Exceptions to Authorization being   CMIA CA Civil Code section 56.21 - Valid authorization – defined                 CMIA CA Civil                        3. Individual
required:                           CMIA CA Civil Code section 56.23 - Employer shall communicate to receiver        Code section                         Participation
of info based on an authorization, any limitations.                              56.21
CMIA CA Civil Code section 56.245 - Recipient of info based on an                CMIA CA Civil
authorization may not further disclose.                                          Code section
CMIA CA Civil Code section 56.30 Disclosure and use of the following             56.23
medical info shall not be subject to the limitations of CMIA 56 regarding: (a)   CMIA CA Civil
mental health records &amp; disabilities, (b) Public Social Services, (c) Public     Code section
Health (d) Licensing &amp; Statistics (e)Medical Surveys, Workers&#39; Safety (f)        6.245
Industrial Accidents (g) Law enforcement (h) Employment Accidents/Illness        CMIA CA Civil
(i) Alcohol or Drug Abuse (j) Patient Discharge Data (k) Insurance               Code section
Commissioner, Managed Care, Worker&#39;s Comp, etc.                                  56.30(a) - (k)
CMIA CA Civil Code section 56.31 Nothing in CMIA 56.30 permits disclosure        CMIA CA Civil
or use of HIV info.                                                              Code section
LPS Welfare and Institutions Code - agency access to records of person with      56.31
developmental disabilities in a developmental disability facility with consent   LPS Welfare and
and no guardian                                                                  Institutions Code
PAHRA Health and Safety Code -entitled to inspect                                section 5010
IPA CA Civil Code section 1798.40 Exceptions to Access - (a) through (h);        PAHRA Health
criminal ID, criminal investigations, enforcement, licensure &amp; employment,       and Safety Code
employment exams, detrimental to individual, workers&#39; comp., required by         section 123110(a)
law, allowed by law                                                              IPA CA Civil
Sub-           Description                                Policy Requirements                                                                       Source              Preemption         Categories
IPA CA Civil Code section 1798.41- (a) exempt from access provide denial in               IPA CA Civil
writing, (b) agency shall conduct review of determination, (c) agency doesn&#39;t             Code section
have to provide a written denial in situations of law (apprehending criminal)             1798.41 (a-c)
IPA CA Civil Code section 1798.42 - 1798.78 all deal with access issues
including: info about others, deletion of exempt info, rights of individual, civil
action, civil penalties, order or judgment, liability, court jurisdiction, civil action
limitations, correction after time limit, public officials liability, intentional
violation, false pretenses, misdemeanor, commercial purposes, license,
names &amp; addresses, mailing lists, rights of privacy, DGS storage, time limits
for access-FTB, leans on real property, district attorneys, Board of
Equalization, supersedes other state law, litigation, disclosures,
constitutional rights to privacy, student records, Public Records Act ,
judicial decisions, modification-transfer or destruction of records, state
Access to      Personal representatives (shall,           HIPAA recognizes a personal representative as having the same rights and                  HIPAA 45 CFR        HIPAA 45 CFR       3. Individual
Individual&#39;s   should, may) be authorized by individual   control authority as the patient subject of the informationCMIA CA Civil Code             section 164.502     section 164.508    Participation
Information    or by law                                  section 56.11 – Various aspects of Authorizations                                                             Tot.P of IPA CA
CMIA CA Civil
By Personal                                                                                                                                                             Civil Code
CMIA CA Civil Code section 56.12 - Upon demand provide to provide copy                    Code section
LPS- Welfare and Institutions Code - agency access to records of person                   56.11&amp; 56.12        section
Individual                                                with developmental disabilities in a developmental disability facility with               LPS Welfare and     1798.24(d)
consent and no guardian                                                                   Institutions Code   Tot.P by 45
PAHRA Health and Safety Code -entitled to inspect                                         section 010         CFR sections
164.502 [uses
IPA CA Civil Code section 1798.20 Rules of conduct                                        PAHRA Health
&amp; disclosures],
IPA CA Civil Code section 1798.23 DOJ shall review every 5 yrs. to                        and Safety Code
164.506 [TPO]
determine if exemption should continue.                                                   section 123110(a)
&amp; 164.508
IPA CA Civil Code section 1798.24(d) use of info by government entities(e)                IPA CA Civil        [authorizations]
constitutional or statutory duties, (f) governmental entity, (g) Public Records           Code section
Act, (h) research, (i) health &amp; safety, (j) state archives, (k) court orders, (l)         1798.20
warrants, (m) DMV, (n) payment Claims, (o) law enforcement, (p)                           IPA CA Civil
investigations, (q)&amp;(r) adopted persons &amp; medically necessary, (s)                        Code section
legislature, (t) UC research, (u) Insurer under DMV, (v) pursuant to Section              1798.23
1909, 8009 or 18396 of the Financial Code, but not disclosure is not required             IPA CA Civil
Sub-            Description                                Policy Requirements                                                                 Source              Preemption       Categories
if Section 1798.40                                                                  Code section
1798.24(d)
1798.24(e)
Amendment       Individual (shall, should, may) have the    Right to request amendments to health information                                  HIPAA 45 CFR        Tot.P of         3. Individual
Individual&#39;s    right to challenge the accuracy and         PAHRA - patient&#39;s right to a written addendum to an incomplete or incorrect        164.526             PAHRA Health     Participation
Information     completeness of their information and       record                                                                                                 and Safety
PAHRA - Health
by Individual   request amendment as appropriate.                                                                                                                  Code section
or Personal                                                 PAHRA Health and Safety Code sections 123110(c ) x-rays123111(a) - (d)             and Safety Code
Organization (shall, should, may)           written addendums, addendums wit disclosures, provider liability, violation by     section 123110(b)   123110(c ) by
ve              determine whether to accept                 provider                                                                           PAHRA Health        45 CFR section
amendment and if declined, has                                                                                                 and Safety Code     164.524
IPA CA Civil Code section 1798.35 - Agencies will permit requests to amend
process for a                                                                                                                  section 123111(a)   PAHRA Health
IPA CA Civil        and Safety
IPA CA Civil Code section 1798.36 - Agencies will permit Disagreement with
Code section        Code section
denials for amendment
1798.35             123111(a)-(d)
 CA Civil Code section 1798.37 - Agency shall clearly note portion in                                  Tot.P by 45
Disagreement when disclosed                                                                           CFR section
 CA Civil Code section 1798.38 Exceptions - employment, adoptive parents,                              164.526
 CA Civil Code section s1798.39 Sections .35, .36 &amp; .37 shall not apply to
evidence of property rights.Implementation [The operational consideration
here for the HIE is how such a request will be received and processed, and
how the amendment/addendum will be communicated to others that have
previously received copies of the amended/addenda information.]]
Right to an accounting of disclosures      Individuals have the right to receive a list of certain disclosures made of their   HIPAA 45 CFR                         3. Individual
medical information.                                                                section 164.528                      Participation
Implementation [Operational consideration for HIE is how disclosures are
classified and recorded to facilitate a response to such a request. CS]
Sub-            Description                                Policy Requirements                                                            Source             Preemption         Categories
Request         Individual (shall, should, may) have the   Right to request privacy protections to health information, including          HIPAA 45 CFR                          5. Use
Restrictions    right to request restrictions on the use   restrictions on the use and disclosure of health information. They can         section 164.522                       Limitation, 3.
and disclosures of his/her health          terminate special restrictions. Entity to make good faith effort to                                                  Individual
information                                accommodate, but not required if operationally impractical.                                                          Participation
Right to        Right to access, inspect and obtain a      Individual has a right of access to inspect and obtain a copy of protected     HIPAA 45 CFR                          3. Individual
access,         copy of health information                 health information, in a particular format, such as electronic.                section 164.524                       Participation
NPP             Individuals have the right to receive      Individuals have the right to receive notice about privacy practice from the   HIPAA 45 CFR       Get the citation   3. Individual
notice about privacy practice from the     holder of the information and any changes to privacy practices                 section 164.520                       Participation
holder of the information
Complaints      Individual have the right to complain      Individual can have the right to file a complaint under federal privacy        HIPAA 45 CFR                          3. Individual
regulations. with the holders of the data or with DHHS                         section 164.530d                      Participation
Suspension      Temporary suspension of rights             in certain instances the individual rights may be suspended for a period of     HIPAA 45 CFR                         3. Individual
of individual                                              time with written notice to patient                                            164.512                               Participation
Right to        Individuals have the right to agree or     That applies to use in directories                                              HIPAA 45 CFR                         3. Individual
agree or        object to the use of their PHI                                                                                            section 164.510                       Participation
Request         Right to request confidential              Right to request private communications                                        HIPAA 45 CFR                          3. Individual
Private         communications – patients have the                                                                                        section 164.522b                      Participation
Communica       right to request communicate with the
tions           patients about medical matters in a
certain way or at a certain location.
Sub-Category                      Description                                              Policy Requirements                                      Source           Preemption     Categories
Protect Information (Data)
Individually Identifiable Health Information/   All individually identifiable health information held or transmitted by a   HIPAA 45 CFR                         2. Health
Protected Health Information IIHI/PHI (See      covered entity or its business associate in any form or media, whether      section 164.501                      Information
glossary)                                       electronic, paper or oral                                                   definitions                          Quality
Confidentiality   Information (shall, should, may) not be         HIPAA - Confidentiality means the property that data or information is      HIPAA – 45 CFR                       2. Health
made available or disclosed to                  not made available or disclosed to unauthorized persons or processes        section 164.502 &amp;                    Information
unauthorized persons                            42 CFR - disclosure only allowed to medical personnel with bon fide         164.512                              Quality, 5.
medical reason                                                              42 CFR Part 2                        Use Limitation
CMIA CA Civil Code - Each employer who receives medical                     CMIA CA Civil
information shall establish appropriate procedures to ensure the            Code section 56.20
confidentiality and protection from unauthorized use and disclosure of
IPA CA Civil Code
section 1798.21
IPA CA Civil Code - same as Integrity
PAHRA Health and
PAHRA Health and Safety Code - implementation of policies and
procedures to include safeguards for confidentiality and unauthorized
section 123149(g)
Anonymity         Anonymity to individual (shall, should,         HIPAA defines De-identified data sets and the process for de-               HIPAA 45 CFR
may) be allowed where lawful and                identifying PHI                                                             section 164.522(b)
practical                                       HIPAA addresses - entity de-identifying has responsibility                  42 CFR Part 2
42 CFR - personnel must not identify                                        IPA CA Civil Code
IPA CA Civil Code - No agency may disclose any personal information         section 1798.24
in a manner that would link the info disclosed to the individual to whom    LPS Welfare and
it pertains unless the info is disclosed as follows:                        Institutions Code
LPS Welfare and Institutions Code - Except as otherwise provided,           section 5328.15
confidential information shall not contain patient&#39;s name.
Availability      Information (shall, should, may) be             42 CFR - disclosure only allowed to medical personnel with bon fide         HIPAA Security       Title 22 -      5. Use
accessible and useable by authorized            medical reasonPAHRA - preserve records for minimum of 7 years               definitions          hospital        Limitation
person                                                                                                                      Availability &amp; 45    licensing
CFR section          regulations &amp;
164.502              JAHCO
Sub-Category                   Description                                              Policy Requirements                                      Source           Preemption    Categories
section 123145(a)
Integrity      Information (shall, should, may) not be         Information has not been altered or destroyed in an unauthorized            HIPAA 45 CFR                        2. Health
altered or destroyed in an unauthorized         manner                                                                      164.530(c)                          Information
manner                                          IPA CA Civil Code - establish safeguards to ensure the security &amp;           IPA CA Civil Code                   Quality
confidentiality of records, &amp; to protect against anticipated threats to     sections 1798.21;
their security or integrity which could result in any injury. Each agency   1798.18
shall maintain all records, to the maximum extent possible, with            IPA CA Civil Code
accuracy, relevance, timeliness, and completeness                           section 1798.24
IPA CA Civil Code section 1798.24 Agency shall de-identify info             CMIA CA Civil
unless (a-v)                                                                Code section
CMIA CA Civil Code - every provider, plan, pharmaceutical, or               56.101
contractor must maintain confidentiality of info from creation to           PAHRA Health and
disposal                                                                    Safety Code
PAHRA Health and Safety Code - All providers set forth in subdivision       section 123149.(b)
(a) shall ensure the safety and integrity of all electronic media used to   CMIA CA Civil
store patient records by employing an offsite backup storage                Code section
CMIA CA Civil Code section 56.102 Disposal of Records                       56.102
PAHRA Health and Safety Code - Any use of record keeping shall              PAHRA Health and
ensure integrity of records of electronic media by employing off-site       Safety Code
back-up storage system, an image mechanism to copy signature                section 123149(b)
documents, and also ensure inalterability of documents. [Applies to
design &amp; operational management of interfaces and other types of
data integrity.]
Ownership      Current law doesn&#39;t pin down ownership,         Ownership of records obtained from other providers (HIPAA patient           Optional in HIPAA    Title 22       5. Use
except in Title 22. Unclear issue, especially   access section) comes into play in disclosure discussions.                                       reference to   Limitation
in an HIE.                                                                                                                                       ownership
For personal health information an              HIPAA requires designation of a Privacy/Security Official by the            HIPAA 45 CFR                        3. Individual
individual (shall, should, may) be              covered entity, assignment of responsibilities and authority to act         section 164.530(a)                  Participation,
designated accountable                          IPA CA Civil Code section 1798.22 Agency shall designate                    IPA CA Civil Code                   8.
responsible employee                                                        section 1798.22                     Accountability
Sub-Category                  Description                                           Policy Requirements                                    Source            Preemption        Categories
For compliance                              HIPAA requires compliance                                                 HIPAA 45 CFR                             8.
CMIA CA Civil Code section 56.20 Establish appropriate procedures         section 164.508                          Accountability
to protect (includes required authorization, no discrimination if         CMIA CA Civil
employee refuses to sign authorization under CA Civil Code section        Code section 56.20
56.11 and restrictions on disclosures).
IPA CA Civil Code section 1798.24a - request made to Law                  IPA CA Civil Code     45 CFR section     8.
Enforcement for concessionaire screening                                  section 1798.24a      164.502 [uses      Accountability
IPA CA Civil Code section 1798.26 any person Requesting info must         IPA CA Civil Code     &amp; disclosures],
identify him/herself.(Sales of DMV info.)                                 section 1798.26       45 CFR section
IPA CA Civil Code section 1798.28 - informing of Amendments Y             Tot.P by HIPAA 45     164.506 [TPO]
changes to disclosure receivers what does this mean?                      CFR section           &amp; 45 CFR
164.528               section 164.508
[authorizations,
To establish third party agreements         HIPAA requires business associate agreements                              HIPAA 45 CFR                             8.
section 164.504(e)                       Accountability
To establish privacy policy                 HIPAA requires establishment of a number of organizational privacy        HIPAA 45 CFR                             8.
policies and procedures to comply with regulations                        section 164.530(c )                      Accountability
IPA CA Civil Code section 1798.21 Agency shall establish safeguards       IPA CA Civil Code
To conduct privacy impact                   We&#39;re not aware of any privacy legal requirement to conduct impact                                                 8.
assessments.                                assessments                                                                                                        Accountability
Oversight      Compliance with policies (shall, should,    CA Public Records Act - Government Code section 6250-6270 &amp;               HIPAA 45 CFR                             8.
may) be monitored with informed public      Freedom of Information Act 5 USC Section 552. Both apply to public        section 164.300                          Accountability
oversight and consumer involvement.         entities and does not grant public access to PHI.
Complaint      There (shall, should, may) be a complaint   Right to file a complaint about privacy issues                            HIPAA 45 CFR                             8.
Process        process. An individual may challenge all    HIPAA requires entities to establish a complaint process; consumers       section 164.                             Accountability
practices not in alignment with stated      can file complaints directly with organization or with Office for Civil   530                                      , 3. Individual
policies.                                   Rights                                                                                                             Participation
Sub-Category                       Description                                               Policy Requirements                                     Source            Preemption     Categories
Information        It (shall, should, may) be easy to               Need to know                                                                HIPAA 45 CFR         CMIA CA Civil   8.
Management         understand what policies are in place,           Minimum necessary                                                           section 164.520      Code section    Accountability
Policy             how they were determined and how to                                                                                                               56.21
HIPAA requirements related to the content of the Notice of Privacy          PAHRA Health and
make inquiries or comment. It (shall,            Practices                                                                   Safety Code
should, may) be clear who has access to                                                                                      section 123149
PAHRA Health and Safety Code section 123149 -Develop &amp;
what information for what purpose.                                                                                           IPA CA Civil Code
implement policies &amp; procedures to include safeguards for
confidentiality &amp; unauthorized access to electronically stored health       section 1798.19
records, authenticated by sig. keys &amp; systems maintenance
IPA CA Civil Code section 1798.19 If agency contracts for record
maintenance, contractor shall comply with law and are considered an
Notice of          There (shall, should, may) be a process for      Right to receive a Notice of Privacy Practices                              HIPAA 45 CFR         CMIA CA Civil   8.
Privacy Policies   providing notice of privacy practices and        HIPAA also stipulates the elements of the process for providing and         section 164.520      Code section    Accountability
and Rights         an individual&#39; privacy rights to individuals     documenting the delivery of the Notice to consumers                                              56.23           , 3. Individual
that clearly describes how personal health       IPA CA Civil Code section 1798.17 - Agency shall provide notice when        IPA CA Civil Code                    Participation
information is handled and made making           collecting info, does not apply to law enforcement &amp; must conform with      section 1798.17
readily available as well as rights individual   Federal Privacy Act of 1974 (Public Law 93-579)
may assert under law, regulations, policy or
Mitigation of      Individuals may make complaint and               Mitigation of harm, in the event of a use or disclosure done in violation   HIPAA 45 CFR                         3. Individual
Harm               request appropriate action                       of privacy requirements or organization’s own policies and procedures       164.530                              Participation,
CMIA CA Civil Code section 56.35 - A patient whose medical info has                                              8.
been used or disclosed in violation of CA Civil Code section 56.10,         CMIA CA Civil                        Accountability
56.104, 56.20 or 56.26 (a) and has sustained loss, may recover              Code section 56.35
damages (HIPAA and CA Civil Code section 56.35)
CMIA CA Civil Code section 56.36 - Violation punishable as a                CMIA CA Civil
misdemeanor, other actions &amp; remedies, fines &amp; civil penalties, Civil       Code section 56.36
PAHRA Health and Safety Code section 123120 Action by Patient for
PAHRA Health and Safety Code section 123145 - person injured as a           section 123120 &amp;
result of licensee&#39;s abandonment of health records may bring action         123145
Sub-Category                    Description                                           Policy Requirements                                   Source           Preemption        Categories
for damage suffered.                                                    IPA CA Civil Code
IPA CA Civil Code section 1798.29 agencies mitigation requirements      section 1798.29
Accounting of    Access (shall, should, may) be tracked       Right to request an accounting of certain disclosures that a covered    HIPAA 45 CFR         IPA CA Civil       8.
Disclosures      and audited. Organizations (shall, should,   entity has made of their PHI                                            section 164.528      Code section       Accountability
(Traceability)   may) provide individual with list of any                                                                                                  1798.25 entities
PAHRA Health and Safety Code section 123130 - Provider may              PAHRA Health and
disclosures outside of policy.               prepare a summary of the record for inspection &amp; copying by patient.    Safety Code          must also
IPA CA Civil Code section 1798.16 - agency shall maintain the source    section 123130       comply with
of info.                                                                IPA CA Civil Code    HIPAA
IPA CA Civil Code section 1798.18 agency shall maintain records with    section 1798.16
accuracy, relevance, timeliness &amp; completeness                          IPA CA Civil Code
IPA CA Civil Code section 1798.25 - Accounting of disclosures           section 798.25.27
IPA CA Civil Code section 1798.27 - Retention of Accounting of          entities must also
Disclosures (45 CFR section 164.308 - Administrative safeguards and     comply with 45
45 CFR section 164.312 - Technical safeguards) requires System          CFR section
Activity Review: &quot;Implement procedures to regularly review records of   164.528(d)
information system activity, such as audit logs, access reports, and
security incident tracking reports&quot;.
Education        Organizations that maintain information      HIPAA requires organizations to provide appropriate                     HIPAA 45 CFR         CMIA CA Civil      8.
(shall, should, may) insure that all         education/training to their staff; HIPAA does NOT require education     section 164.530(b)   Code section       Accountability
authorized users receive adequate            of consumers                                                                                 56.245
instruction on proper collection, use and    IPA CA Civil Code section 1798.20 Rules of conduct                      IPA CA Civil Code
disclosure of information                                                                                            section 1798.20
work in progress, the user, first order, configuration file, data model, a work in progress, how to, working draft, design document, key concepts, first order logic, reference implementation, common logic, information flow, meta object facility
Work Program Elements and Progress