Health Care Department Operations Manual

Chapter 2 – Patients’ Entitlements and Responsibilities

Article 3 – Health Information Management

View All Sections >

2.3.4 Release of Protected Health Information

Policy
- California Correctional Health Care Services (CCHCS) shall release requested Protected Health Information (PHI) with authorization in accordance with applicable law, timely evaluation, and appropriate processing.
Purpose
- To provide guidance regarding the required criteria for handling and responding to routine requests for release of PHI for purposes other than treatment payment and health care operations, and where required or permitted by law.
Applicability
- This policy applies to the release of PHI in any form (health records, other types of written communication, and verbal information) pursuant to a valid authorization, court order, administrative order, or subpoena.
- This policy does not apply to disclosures permitted by law in which a patient authorization is not required for release of information. Refer to the Health Care Department Operations Manual (HCDOM) Section 2.2.6, Use and Disclosure of Protected Health Information: Special Exceptions for these special situations.
Responsibility
- Statewide
  - Under the direction of the Deputy Director, Medical Services, and Health Information Management (HIM) Chief:
  - Institution Health Records staff, within the scope of their authority, are responsible for oversight, implementation, monitoring, and evaluation of this policy for current patients.
  - Health and Imaging Record Center (HIRC) staff, within the scope of their authority, are responsible for oversight, implementation, monitoring, and evaluation of this policy for paroled or discharged persons.
  - Health Records staff at institutions (for currently incarcerated persons), and HIRC staff (for paroled and discharged persons) are responsible for processing all other requests for health information.
- Regional
  - Health Care Executives are responsible for the administration of this policy at the subset of institutions within their assigned region.
- Institutional
  - The Chief Executive Officer (CEO), or designee, of each institution has the overall responsibility for implementation and ongoing oversight of this policy.
- CCHCS workforce members shall ensure compliance with this policy and federal and state privacy laws containing protections and additional restrictions for the access, use or disclosure of PHI.
Procedure
- Routine Authorization
  - Workforce members shall respond to a valid written authorization for release of PHI. CCHCS shall accept either the CDCR 7385, Authorization for Release of Protected Health Information, or an alternative form that conforms to the requirements of Section (e)(4) below.
  - For access purposes, patient representatives shall be treated in the same manner as the patient who is the subject of the health information unless there is an exception set forth in (e)(6)(B)(3) below.
- Court Orders, Administrative Order or Subpoena
  - Workforce members shall comply with all properly executed court orders, administrative orders, or subpoena in accordance with section (e)(6) and (e)(7) as follows:
    - If a court order, administrative order, or subpoena arrives at an institution through the Litigation Coordinators, it shall be transmitted to HIM for record collection.
      - Unless otherwise advised by legal counsel, CCHCS shall comply with a subpoena that is not accompanied by a court order compelling disclosure of PHI if:
        
        CCHCS receives satisfactory assurances from the party seeking the PHI that the patient has received notice of the subpoena, or a good faith effort has been made to provide the patient with notice of the subpoena, in the form of a written statement and accompanying documentation demonstrating that:
        
        The party requesting such information has made a good faith attempt to provide written notice to the patient (or if the patient’s location is unknown, to mail a notice to the patient’s last known address);
        
        The notice included sufficient information about the litigation or proceeding in which the PHI is requested to permit the patient to raise an objection to the court or the administrative tribunal; and
        
        The time for the patient to raise objections to the court or administrative tribunal has elapsed, and there were either no objections filed, or all objections filed by the patient have been resolved by the court or the administrative tribunal and the disclosures being sought are consistent with such resolution; or
        
        A qualified protective order has been agreed to by the parties and issued by the jurisdictional court.
    - HIM shall consult with legal counsel regarding any court order, administrative order, or subpoena, based on enforcement of another state’s law, that is related to protected health care services that are lawful in this state, including reproductive services and gender affirming care.
    - If a court order, administrative order, or subpoena arrives at HIM, and validity of the documents is in question, HIM staff shall collaborate with legal counsel and the Health Care Litigation Support Section, as necessary, to ensure proper review, and determination of validity.
- Special Authorization
  - Specially Protected Health Information
    - Patients must specifically authorize the release of the following specially protected health information:
      - HIV Test Results. A written authorization is required for each separate disclosure.
      - DDS Service Records, which includes regional center developmental disability information and records for services provided to persons with developmental disabilities in a developmental disability center covered under Division 4.1, Division 4.5, Division 6, or Division 7, of the Welfare and Institutions Code (“DDS Services”). Records related to developmental disability services provided inside CDCR do not constitute “regional center developmental disability information.”
      - Part 2 Program Service Records, which include substance use treatment information and records relating to the identity, diagnosis, prognosis, or treatment of any patient by a federally assisted alcohol or drug treatment program regulated by the Federal Code of Regulations, Title 42, Part 2, including a Narcotic Treatment Program (“Part 2 Program Services”). Records related to alcohol and drug treatment provided by CCHCS do not constitute “substance use treatment information,” because CCHCS is not a Part 2 program.
    - The release of any specially protected health information is subject to CCHCS policy and applicable law.
  - Genetic Information for Underwriting Purposes
    - CCHCS shall not use or disclose genetic information for underwriting purposes. HIM shall consult legal counsel to discuss any authorization requests specifically related to genetic information.
  - Psychotherapy Notes
    - CCHCS providers do not create psychotherapy notes. Further, CCHCS does not make it a practice to request, nor is it an expectation to accept psychotherapy notes when CCHCS requests mental health records from outside providers for the continuity of care of patients. HIM shall consult legal counsel to discuss any authorization requests specifically related to psychotherapy notes.
  - Mental Health Records
    - Mental health records are PHI and have the same protection afforded to other PHI. The only mental health records that have heightened protection are psychotherapy notes.
- Components of a Valid Authorization
  - Format of Authorization
    - The authorization shall:
      - Have typeface of a least 14-point font or be a handwritten document.
      - Be clearly separate from any other language present on the page.
  - Identification of Patient
    - The authorization shall include the patient’s name, CDCR number, and date of birth.
  - Identity of Disclosing Party
    - The authorization shall include the name or other specific identification of the person(s) or organization(s) authorized to disclose the PHI.
  - Identity of Recipient
    - The authorization shall include the name or other identification of the person(s), class of persons, or organization(s) authorized to receive the PHI.
  - Specific Description of Information Authorized for Release
    - The authorization shall include a specific and meaningful description to instruct HIM regarding the PHI to be disclosed.
  - Purpose of Use or Disclosure
    - The authorization shall include a description of each purpose of the requested use or disclosure, including any limitations on the use or disclosure of the PHI by the persons or entities authorized to receive the PHI.
  - Expiration
    - The authorization shall include an expiration date or event, which must be limited to one year unless the person signing it requests a longer timeframe.
  - Statement of Right to Revoke
    - The authorization shall include a statement that the patient has a right to revoke the authorization. The statement shall also explain how revocation is accomplished, including that it shall be in writing, and tell the patient about exceptions applicable to the revocation.
  - Signature and Date
    - For the patient, the authorization shall be signed and dated by the patient and the signature shall serve no other purpose than to execute the authorization.
    - For the agent, the authorization shall be signed and dated by the agent and shall include a description of the agent’s authority to act on behalf of the patient. A copy documenting the agent’s authority shall be attached (e.g., power of attorney, letters issued in estate proceeding, or declaration of next of kin.)
  - Authorization as a Condition
    - The authorization shall state that CCHCS cannot condition treatment of the patient on obtaining a signed authorization.
  - Redisclosure
    - The authorization shall state that if the person or organization that receives the PHI is not subject to the Health Insurance Portability and Accountability Act of 1996, then the PHI may be subject to disclosure and may no longer be protected by federal and state privacy regulations.
  - Copy
    - The authorization shall state that the person signing it has the right to receive a copy of the authorization.
- Defective Authorizations
  - An authorization is not valid, and shall not be relied upon to disclose PHI if:
    - The expiration date or event has passed.
    - Any required information is missing.
    - It has been revoked.
    - CCHCS becomes aware that information in the authorization is false.
    - The authorization violates restrictions on authorizations, such as combining the release of PHI with a patient’s consent for care.
  - If an authorization is not valid, HIM shall notify the patient of why the authorization is not valid.
  - If changes are necessary to an authorization, the requester may submit a new authorization form.
- Releasing PHI
  - Verification of Identity and Legal Authority
    - Identity
      - CCHCS shall verify the identity of any person or entity requesting disclosure if the identity is not already known.
    - Authority
      - CCHCS shall verify the authority of any person or entity requesting disclosure that is not the patient and if the authority is not already known. Acceptable forms of documentation that give authority include:
      - Power of Attorney (shall include a provision that allows medical decision-making or release of health records).
      - Next of Kin declaration (for deceased patients only).
      - Other form of official documentation (e.g., identification of party as executor of the will, administrator of the estate or conservator).
    - The verification requirements are satisfied if CCHCS relies on the exercise of professional judgement in making a use or disclosure or acts on a good faith belief in making a disclosure.
  - Processing Request and Preparation of Records
    - Log Receipt of Request
      - Upon receipt of a valid authorization or a properly executed court order, administrative order, or subpoena, CCHCS shall log the request into the Access HIM application in the Electronic Health Record System.
    - Identify Information for Release
      - CCHCS shall retrieve the requested documents from the record, corresponding with the requestor if necessary. If the requested documents are in paper format, they shall be scanned into the health record.
      - CCHCS shall prepare only the minimum necessary amount of PHI to be released pursuant to the authorization, order, or subpoena; however, if the patient has requested the release of information, the minimum necessary standard does not apply.
      - HIM shall redact information that has not been authorized for release.
      - HIM shall include a disclosure statement when applicable.
        
        The following disclosure statement must accompany a disclosure of HIV test results:
        
        “This information has been disclosed to you from records whose confidentiality is protected by state law. State law prohibits you from making any further disclosure of it without the specific written consent of the person to whom it pertains, or as otherwise permitted by law. A general authorization for release of medical or other information is not sufficient for this purpose.”
        
        The following disclosure statement must accompany a disclosure of substance use treatment information (services provided outside CDCR):
        
        “(1) This information has been disclosed to you from records protected by federal confidentiality rules (42 CFR part 2). The federal rules prohibit you from making any further disclosure of information in this record that identifies a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person unless further disclosure is expressly permitted by the written consent of the individual whose information is being disclosed or as otherwise permitted by 42 CFR part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose (see §2.31). The federal rules restrict any use of the information to investigate or prosecute with regard to a crime any patient with a substance use disorder, except as provided at §§ 2.12(c)(5) and 2.65; or (2) 42 CFR part 2 prohibits unauthorized disclosure of these records.”
    - Exceptions to Granting Access
      - For access purposes, patient representatives shall be treated in the same manner as the patient who is the subject of the health information unless there is a reasonable belief that:
        
        The patient has been or may be subject to domestic violence, abuse, or neglect by the individual.
        
        Treating such individual as the patient’s representative could endanger the individual.
        
        CCHCS, in the exercise of their expert knowledge and opinion, decides it is not in the best interest of the patient to treat the individual as the patient’s representative.
      - CCHCS shall not release health information compiled in anticipation of use in a civil, criminal, or administrative action or proceeding.
      - CCHCS may deny releasing PHI obtained from someone other than a health care provider under a promise of confidentiality if the release would be reasonably likely to reveal the source of the information.
      - Review of Mental Health Records Prior to Release
        
        If a request is for release of mental health records to an individual (e.g., patient, patient representative, family member), then HIM shall submit the records to the Chief of Mental Health, or their designee for review to determine whether there is a substantial risk of significant adverse or detrimental consequences to the patient or another person if the patient or patient representative reviews the records.
        
        If the Chief of Mental Health, or designee, determines the records may be released, then they shall notify HIM and HIM shall release the records within 15 business days of the date of the patient’s initial request.
        
        If the Chief of Mental Health, or designee, determines the records should not be released in their current form, then the following shall occur:
        
        The Chief of Mental Health, or designee, shall provide HIM with the following:
        
        Documentation which indicates what records shall not be released with a description of the “specific adverse or detrimental consequences to the patient” the provider anticipates would occur if review were permitted.
        
        A statement to be shared with the patient that, in plain language, provides an explanation for refusing the release and information regarding the patient’s option to permit inspection by an alternative licensed mental health provider or licensed social worker, and information regarding how to file a complaint or health care grievance.
        
        Upon receipt of that information, HIM shall:
        
        Scan the provider’s documentation and statement into the health record.
        
        Provide the patient with notification of the refusal to permit inspection of certain records, reason for the refusal (the statement prepared by the provider), information regarding the patient’s option to permit inspection by an alternative licensed mental health provider or licensed social worker, and information regarding how to file a complaint or health care grievance.
        
        If the patient requests an alternative provider review their records, HIM shall log the request and provide copies of the records to the licensed mental health professional designated by the patient.
      - CCHCS may deny, in whole or in part, a patient’s request to obtain PHI, if obtaining PHI would jeopardize the health, safety, security, custody, or rehabilitation for the patient or other patients, or the safety of any officer, employee, or other person at CCHCS or responsible for the transporting of the patient.
      - CCHCS shall comply with the federal information blocking regulations as outlined in 45 CFR Part 171 and will not engage in practices that unreasonably interfere with the access, exchange, or use of electronic health information.
      - If CCHCS denies access, a written statement shall be provided by the determinant describing the basis for the denial and an explanation of the patient’s options for review of the denial, which may include completing a CDCR 602-HC Health Care Grievance. Further, HIM shall make a written record to be included with the health records requested, noting the date of the request and the reason for refusing to permit release of the records.
  - Arrange Delivery
    - Verbal
      - CCHCS shall verbally release information to a recipient who has a valid authorization and shall document such release in the health record.
    - Written
      - HIM shall release the records along with a declaration of records and shall document such release in the health record.
  - If the records were released pursuant to a court order, administrative order, or subpoena, HIM shall scan the signed document into the health record.
- Accounting of Disclosures
  - CCHCS shall keep an accurate accounting of each disclosure as set forth in the HCDOM Section 2.2.18, Accounting of Disclosures. The accounting shall include the name of the patient, a description of the PHI disclosed, a brief description of the reason for the disclosure (e.g., subpoena, completed CDCR 7385), the date of the disclosure, and the name, title, and address of the individual or organization to whom the disclosure was made.
- Processing Timeframes
  - If a request is valid and the information can be located, CCHCS staff shall provide the records within 15 business days.
  - If a request is valid but CCHCS does not maintain the record, CCHCS workforce members shall notify the patient within 15 business days and advise the patient of where to direct their request for access if CCHCS knows where the PHI is maintained.
  - If a request is valid but CCHCS cannot produce the records within 15 business days, CCHCS staff shall provide written notification advising the patient of a delay and the estimated date by which the records will be provided. CCHCS has an additional 15 business days to produce the records.
  - If an authorization is not valid CCHCS staff shall notify the patient within 15 business days and provide them with the opportunity to complete a new authorization.
- Fee Schedule
  - CCHCS shall not charge a currently incarcerated person for the release of health records.
  - CCHCS may charge a fee (to parties that are not currently incarcerated persons, pursuant to section (e)(9)(A) above) to offset the costs associated with responding to requests for health records. The fee shall be consistent with applicable federal and state law and shall be based on an assessment of factors such as the current cost of equipment and supplies, labor costs, postage, and administrative overhead.
- Authorization Modification or Revocation
  - To modify or revoke an authorization, the patient shall send a written revocation to CCHCS. If CCHCS receives a written revocation, all disclosure of PHI shall stop, except as follows:
    - Any actions taken in reliance on the authorization before the receipt of the modification or revocation are not affected by the modification or revocation.
    - If a partial revocation is received, the disclosure of PHI not affected by the partial revocation shall continue.
  - Exceptions to a Written Revocation Rule.
    - CCHCS may request but cannot require a revocation for substance use treatment information (services provided outside CDCR) to be in writing. The patient may revoke the authorization verbally or in writing.
- Documentation of all Authorizations, Modifications and Revocations
  CCHCS shall maintain any authorization, modification, or revocation applied to authorizations for a minimum of six years from the date of request.
References
- Code of Federal Regulations, Title 42, Part 2, Confidentiality of Substance Use Disorder, Subparts A-E, Sections 2.1-2.67
- Code of Federal Regulations, Title 45, Subtitle A, Chapter A, Subchapter C, Part 160, 164
- Code of Federal Regulations, Title 45, Subtitle A, Subchapter C, Part 164, Subpart E, Section 164.502(a)
- Code of Federal Regulations, Title 45, Subtitle A, Subchapter D, Part 171, Subpart A, Sections 171.100-171.103
- California Civil Code, Division 1, Part 2.6, Chapter 2, Sections 56.10 and 56.109
- California Code of Civil Procedure, Part 4, Title 4, Chapter 12, Article 1, Sections 2029.300 and 2029.350
- California Civil Code, Division 3, Part 4, Title 1.8, Chapter 1, Article 6, Section 1798.24
- California Health and Safety Code, Division 10, Part 4, Chapter 7, 120980(g)
- California Health and Safety Code, Division 106, Part 1, Chapter 1, Section 11845.5
- California Health and Safety Code, Division 106, Part 1, Chapter 1, Section 123110
- California Health and Safety Code, Division 106, Part 1, Chapter 1, Section 123115(b)
- California Insurance Code, Division 1, Part 2, Chapter 1, Article 6.6, Section 791.02
- California Penal Code, Part 2, Title 10, Chapter 3, Section 1326
- California Penal Code, Part 3, Title 7, Chapter 1, Section 5007.6
- California Welfare and Institutions Code, Division 5, Part 1, Chapter 2, Article 7, Section 5328
- California Welfare and Institutions Code, Division 4.5, Chapter 1.6, Section 4514
- Health Care Department Operations Manual, Section 2.2.1 General Use and Disclosure of Protected Health Information
- Health Care Department Operations Manual, Section 2.2.18 Accounting of Disclosures
- Statewide Health Information Policy Manual, Section 2.1.1 – Authorizations
- Statewide Health Information Policy Manual, Section 2.2.19 – Information Blocking
Revision History
- Effective: 01/2002
  Revised: 01/07/2026