Health Care Department Operations Manual

Cancel

Chapter 2 – Patients’ Entitlements and Responsibilities

Article 2 – Confidentiality and Privacy

View All Sections >

2.2.7 Patient Privacy Rights

  • Policy

    • California Correctional Health Care Services (CCHCS) shall provide patients’ rights related to the use and disclosure of their Protected Health Information (PHI) and Personally Identifiable Information (PII) as outlined in this policy.

  • Purpose

    • To provide guidance with respect to the privacy rights of patients regarding the use and disclosure of their PHI and PII.

  • Responsibility

    • The Chief Privacy Officer shall have oversight of this policy to comply with privacy laws, policies, and standards for respecting the rights of individuals concerning the collection, use, and disclosure of PHI and PII maintained by CCHCS.

    • CCHCS program areas shall ensure that procedures are developed and consistent with this policy while also ensuring workforce member compliance.

  • Patient Privacy Rights

    • Right to Access PHI and PII

      • CCHCS and Business Associates (BA) shall provide patients with access to inspect, review, and obtain a copy of their PHI and PII in their health record for as long as they are maintained in the health record except for when:

        • Compiled in anticipation of or use in a civil, criminal, or administrative action or proceeding.

        • Determined by the patient’s mental health provider to present a substantial risk of significant adverse or detrimental consequences to the patient in seeing or receiving a copy of the requested records. Such a denial of access is subject to procedures set forth in the Health Care Department Operations Manual (HCDOM), Chapter 2, Article 3, Health Information Management.

        • Protected by attorney work-product privilege.

        • Endangering the health, safety, security, custody, or rehabilitation of the individual or of other patients or the safety of any officer, employee, other person at the correctional institution, or individual responsible for the transporting of the patient.

        • Prohibited by law.

      • For access purposes, patient representatives are treated in the same manner as the patient, except if CCHCS is aware the patient has been or may be subject to domestic violence, abuse, neglect, or other endangerment by the individual and CCHCS decides it is not in the best interest to do so.

      • Information about a patient’s right to access specially protected health information can be found in the Statewide Health Information Policy Manual (SHIPM) Section, 2.3.0, Specially Protected Information.

      • Workforce members shall follow procedures pursuant to the HCDOM, Section 2.3.4, Release of Protected Health Information, when responding to a patients’ request to access their health record.

    • Right to Amend PHI and PII

      • A patient or patient’s representative may request any portion of the patient’s health record to be changed, corrected, or amended by CCHCS.

        • All requests for amendments shall be made in writing and submitted to Health Information Management (HIM) staff at the patient’s institution by utilizing the CDCR 7236, Request to Amend Health Records.

        • CCHCS is not obligated to agree to an amendment and may deny requests or partially accept amendments.

        • The patient or patient’s representative may file a statement of disagreement if they do not agree with the denial or partial approval of their request.

          • CCHCS shall prepare and provide a written rebuttal to the patient or patient’s representative to the statement of disagreement.

      • Workforce members shall follow procedures pursuant to the HCDOM Section 2.3.16, Patient’s Right to Amend Health Record, when responding to a patient’s request to amend their health record.

    • Right to Request an Accounting of Disclosures

      • Patients have the right to request and receive an accounting of disclosures CCHCS has made of their PHI for up to six years prior to the date of requesting such accounting.  CCHCS shall account for all disclosures of PHI except for disclosures:

        • To carry out Treatment, Payment, or Health Care Operations (TPO) activities.

        • Made to the patient.

        • Authorized by the patient.

        • To persons involved in the patient’s care.

        • For national security or intelligence purposes.

        • Made to correctional institutions or law enforcement officials having lawful custody of a patient.

        • Made as part of a Limited Data Set (LDS) pursuant to the HCDOM, Section 2.2.8, De-Identification of Patient Information and Use of Limited Data Sets.

      • Patients have the right to receive an accounting of disclosures CCHCS has made of their non-medical PII for up to three years after the disclosure or until the disclosed information is destroyed, whichever is shorter.  CCHCS shall account for all disclosures of PII except for disclosures:

        • Made to the patient or the patient’s duly appointed guardian, representative, or conservator.

        • Authorized by the patient.

        • To CCHCS workforce members where disclosure is necessary for the performance of official duties and is related to the purpose for which the information was acquired.

        • Pursuant to the California Public Records Act.

        • Made as part of a LDS pursuant to the HCDOM, Section 2.2.8, De-Identification of Patient Information and Use of Limited Data Sets.

      • Workforce members shall follow procedures pursuant to the HCDOM, Section 2.2.18, Accounting of Disclosures for Patients’ Protected Health Information, when responding to a patient’s request for an accounting of disclosures.

    • Right to Request a Restriction on Uses and Disclosures of PHI and PII

      • Patients have the right to request restrictions on the uses and disclosures of their PHI and PII while carrying out TPO activities.  All requests shall be submitted in writing.

      • CCHCS is not obligated to agree to a restriction and may deny the request or agree to a restriction more limited than the patient requested.  HIM staff shall be responsible for receiving and processing any requests for restriction.

    • Right to Request Confidential Communication

      • CCHCS shall ensure confidential communications to the patient are made at the appropriate patient location within a CDCR facility. Patients have a right to request to receive confidential communications related to health information by alternative means or at an alternative location under the following conditions:

        • The confidential communication can be accommodated after considering the need to maintain the safety and security of patients or staff and the safety and good order of the institution.

        • The request is provided in writing.

        • An alternative address or other method of contact is provided.

        • Information as to how payment, if any, shall be handled.

      • Any written requests received shall be forwarded to HIM for processing.

      • CCHCS and BAs shall communicate the request for confidential communication within two business days of the request to each other.

      • CCHCS shall not ask for an explanation from the patient as to why the request is being made, as an explanation is not required. The request cannot be denied solely because an explanation was not given.

      • Workforce members shall follow procedures pursuant to SHIPM, Section 5.5.2, Confidential Communication when responding to a patient’s request for confidential communication.

  • Notice to Patients of Privacy Rights

    • The requirements of the Code of Federal Regulations, Title 45, Section 164.520(a)(3) do not apply to CCHCS patients. CCHCS is not required to provide a Notice of Privacy Practices to patients.

    • CCHCS notifies patients of their privacy rights in various ways including, but not limited to, notices in the clinics, law libraries, and the CCHCS Patient Orientation to Health Care Services handbook.

    • Right to File Complaints

      • Patients may object to specific uses and disclosures of their health information through the health care grievance process.

      • Patients have the right to submit complaints if they believe their PHI or PII has been improperly used or disclosed or if they have concerns regarding compliance with the CCHCS privacy policies. Such complaints may be filed through the health care grievance process.

      • Patients have the right to file a complaint with the Secretary of the U.S. Department of Health and Human Services if they believe there has been non-compliance with the Health Insurance Portability and Accountability Act or other applicable law. This right cannot be waived.  CCHCS is prohibited from requesting that a patient waive this right for any reason, including as a condition of the provision of treatment, payment, enrollment in a health care plan, or eligibility for benefits.

  • References

    • Code of Federal Regulations, Title 45, Subtitle A, Subchapter C, Part 164, Subpart E, Section 164.502

    • Code of Federal Regulations, Title 45, Subtitle A, Subchapter C, Part 164, Subpart E, Section 164.520

    • Code of Federal Regulations, Title 45, Subtitle A, Subchapter C, Part 164, Subpart E, Section 164.524

    • Code of Federal Regulations, Title 45, Subtitle A, Subchapter C, Part 164, Subpart E, Section 164.526

    • Code of Federal Regulations, Title 45, Subtitle A, Subchapter C, Part 164, Subpart E, Section 164.528

    • Code of Federal Regulations, Title 45, Subtitle A, Subchapter C, Part 164, Subpart E, Section 164.530

    • California Health & Safety Code, Division 106, Part 1, Chapter 1, Section 123100 et seq.

    • California Code of Regulations, Title 15, Division 3, Chapter 1, Subchapter 4, Article 9.5, Section 3370(c)

    • California Code of Regulations, Title 15, Division 3, Chapter 1, Subchapter 5, Article 6, Section 3450 et seq.

    • California Civil Code, Division 3, Part 4, Title 1.8, Chapter 1, Article 2, Section 1798.3

    • California Public Records Act, California Government Code, Title 1, Division 7, Chapter 3.5, Article 1, Sections 6250 through 6270

    • Health Care Department Operations Manual, Chapter 2, Article 2, Section 2.2.8, De-Identification of Patient Information and Use of Limited Data Sets

    • Health Care Department Operations Manual, Chapter 2, Article 2, Section 2.2.18, Accounting of Disclosures for Patients’ Protected Health Information

    • Health Care Department Operations Manual, Chapter 2, Article 3, Section 2.3.4, Release of Information

    • Health Care Department Operations Manual, Chapter 2, Article 3, Section 2.3.16, Patient’s Right to Amend Health Record

    • Health Care Department Operations Manual, Chapter 2, Article 3, Health Information Management

    • Health Care Department Operations Manual, Chapter 5, Article 1, Section 5.1.7, Health Care Grievance

    • Health Care Department Operations Manual, Chapter 5, Article 9, Section 5.9.1, General Training Requirements

    • Statewide Health Information Policy Manual, Section 2.2.8, Opportunity to Agree or Object

    • Statewide Health Information Policy Manual, Section 2.3.0, Specially Protected Information

    • Statewide Health Information Policy Manual, Section 4.1.6, Waiver of Rights Related to Health Insurance Portability and Accountability Act Complaints

    • Statewide Health Information Policy Manual, Section 5.4.1, Patient’s (Individual’s) Right to Access Health Information

    • Statewide Health Information Policy Manual, Section 5.5.2, Confidential Communication

  • Revision History

    • Effective: 02/2012
      Revised: 08/20/2025