56.103.

 (a) A provider of health care may disclose medical information to a county social worker, a probation officer, a foster care public health nurse acting pursuant to Section 16501.3 of the Welfare and Institutions Code, or any other person who is legally authorized to have custody or care of a minor for the purpose of coordinating health care services and medical treatment provided to the minor, including, but not limited to, the sharing of information related to screenings, assessments, and laboratory tests necessary to monitor the administration of psychotropic medications.

(b) For purposes of this section, health care services and medical treatment includes one or more providers of health care providing, coordinating, or managing health care and related services, including, but not limited to, a provider of health care coordinating health care with a third party, consultation between providers of health care and medical treatment relating to a minor, or a provider of health care referring a minor for health care services to another provider of health care.

(c) (1) For purposes of this section, except as specified in paragraph (2), a county social worker, a probation officer, foster care public health nurse, or any other person who is legally authorized to have custody or care of a minor shall be considered a third party who may receive any of the following:

(A) Medical information described in Sections 56.05 and 56.10.

(B) Protected health information described in Section 160.103 of Title 45 of the Code of Federal Regulations.

(d) Medical information disclosed to a county social worker, probation officer, foster care public health nurse, or any other person who is legally authorized to have custody or care of a minor shall not be further disclosed by the recipient unless the disclosure is for the purpose of coordinating health care services and medical treatment of the minor and the disclosure is authorized by law. Medical information disclosed pursuant to this section may not be admitted into evidence in any criminal or delinquency proceeding against the minor. Nothing in this subdivision shall This subdivision does not prohibit identical evidence from being admissible in a criminal proceeding if that evidence is derived solely from lawful means other than this section and is permitted by law.

(e) (1) Notwithstanding Section 56.104, if a provider of health care determines that the disclosure of medical information concerning the diagnosis and treatment of a mental health condition of a minor is reasonably necessary for the purpose of assisting in coordinating the treatment and care of the minor, that information may be disclosed to a county social worker, probation officer, foster care public health nurse, or any other person who is legally authorized to have custody or care of the minor. The information shall not be further disclosed by the recipient unless the disclosure is for the purpose of coordinating mental health services and treatment of the minor and the disclosure is authorized by law.

(2) As used in this subdivision, “medical information” does not include psychotherapy notes as defined in Section 164.501 of Title 45 of the Code of Federal Regulations.

(f) The disclosure of information pursuant to this section is not intended to limit the disclosure of information when that disclosure is otherwise required by law.

(g) For purposes of this section, “minor” means a minor taken into temporary custody or as to whom a petition has been filed with the court, or who has been adjudged to be a dependent child or ward of the juvenile court pursuant to Section 300 or 601 of the Welfare and Institutions Code.

(h) (1) Except as described in paragraph (1) of subdivision (e), nothing in this section shall be construed to this section does not limit or otherwise affect existing privacy protections provided for in state or federal law.

(2) Nothing in this section shall be construed to This section does not expand the authority of a social worker, probation officer, foster care public health nurse, or custodial caregiver beyond the authority provided under existing law to a parent or a patient representative regarding access to medical information.

1280.15.

 (a) A clinic, health facility, home health agency, or hospice licensed pursuant to Section 1204, 1250, 1725, or 1745 shall prevent unlawful or unauthorized access to, and use or disclosure of, patients’ medical information, as defined in Section 56.05 of the Civil Code and consistent with Section 1280.18. 1280.18, including the information described in subdivision (b) of Section 11165.13 of the Penal Code. For purposes of this section, internal paper records, electronic mail, or facsimile transmissions inadvertently misdirected within the same facility or health care system within the course of coordinating care or delivering services shall not constitute unauthorized access to, or use or disclosure of, a patient’s medical information. The department, after investigation, may assess an administrative penalty for a violation of this section of up to twenty-five thousand dollars ($25,000) per patient whose medical information was unlawfully or without authorization accessed, used, or disclosed, and up to seventeen thousand five hundred dollars ($17,500) per subsequent occurrence of unlawful or unauthorized access, use, or disclosure of that patient’s medical information. For purposes of the investigation, the department shall consider the clinic’s, health facility’s, agency’s, or hospice’s history of compliance with this section and other related state and federal statutes and regulations, the extent to which the facility detected violations and took preventative action to immediately correct and prevent past violations from recurring, and factors outside its control that restricted the facility’s ability to comply with this section. The department shall have full discretion to consider all factors when determining whether to investigate and the amount of an administrative penalty, if any, pursuant to this section.

(b) (1) A clinic, health facility, home health agency, or hospice to which subdivision (a) applies shall report any unlawful or unauthorized access to, or use or disclosure of, a patient’s medical information to the department no later than 15 business days after the unlawful or unauthorized access, use, or disclosure has been detected by the clinic, health facility, home health agency, or hospice.

(2) Subject to subdivision (c), a clinic, health facility, home health agency, or hospice shall also report any unlawful or unauthorized access to, or use or disclosure of, a patient’s medical information to the affected patient or the patient’s representative at the last known address, or by an alternative means or at an alternative location as specified by the patient or the patient’s representative in writing pursuant to Section 164.522(b) of Title 45 of the Code of Federal Regulations, no later than 15 business days after the unlawful or unauthorized access, use, or disclosure has been detected by the clinic, health facility, home health agency, or hospice. Notice may be provided by email only if the patient has previously agreed in writing to electronic notice by email.

(c) (1) A clinic, health facility, home health agency, or hospice shall delay the reporting, as required pursuant to paragraph (2) of subdivision (b), of any unlawful or unauthorized access to, or use or disclosure of, a patient’s medical information beyond 15 business days if a law enforcement agency or official provides the clinic, health facility, home health agency, or hospice with a written or oral statement that compliance with the reporting requirements of paragraph (2) of subdivision (b) would likely impede the law enforcement agency’s investigation that relates to the unlawful or unauthorized access to, and use or disclosure of, a patient’s medical information and specifies a date upon which the delay shall end, not to exceed 60 days after a written request is made, or 30 days after an oral request is made. A law enforcement agency or official may request an extension of a delay based upon a written declaration that there exists a bona fide, ongoing, significant criminal investigation of serious wrongdoing relating to the unlawful or unauthorized access to, and use or disclosure of, a patient’s medical information, that notification of patients will undermine the law enforcement agency’s investigation, and that specifies a date upon which the delay shall end, not to exceed 60 days after the end of the original delay period.

(2) If the statement of the law enforcement agency or official is made orally, then the clinic, health facility, home health agency, or hospice shall do both of the following:

(A) Document the oral statement, including, but not limited to, the identity of the law enforcement agency or official making the oral statement and the date upon which the oral statement was made.

(B) Limit the delay in reporting the unlawful or unauthorized access to, or use or disclosure of, the patient’s medical information to the date specified in the oral statement, not to exceed 30 calendar days from the date that the oral statement is made, unless a written statement that complies with the requirements of this subdivision is received during that time.

(3) A clinic, health facility, home health agency, or hospice shall submit a report that is delayed pursuant to this subdivision not later than 15 business days after the date designated as the end of the delay.

(d) If a clinic, health facility, home health agency, or hospice to which subdivision (a) applies violates subdivision (b), the department may assess the licensee a penalty in the amount of one hundred dollars ($100) for each day that the unlawful or unauthorized access, use, or disclosure is not reported to the department or the affected patient, following the initial 15-day period specified in subdivision (b). However, the total combined penalty assessed by the department under subdivision (a) and this subdivision shall not exceed two hundred fifty thousand dollars ($250,000) per reported event. For enforcement purposes, it shall be presumed that the facility did not notify the affected patient if the notification was not documented. This presumption may be rebutted by a licensee only if the licensee demonstrates, by a preponderance of the evidence, that the notification was made.

(e) In enforcing subdivisions (a) and (d), the department shall take into consideration the special circumstances of small and rural hospitals, as defined in Section 124840, and primary care clinics, as defined in subdivision (a) of Section 1204, in order to protect access to quality care in those hospitals and clinics. When assessing a penalty on a skilled nursing facility or other facility subject to Section 1423, 1424, 1424.1, or 1424.5, the department shall issue only the higher of either a penalty for the violation of this section or a penalty for violation of Section 1423, 1424, 1424.1, or 1424.5, not both.

(f) All penalties collected by the department pursuant to this section, Sections 1280.1, 1280.3, and 1280.4, shall be deposited into the Internal Departmental Quality Improvement Account, which is hereby created within the Special Deposit Fund under Section 16370 of the Government Code. Upon appropriation by the Legislature, moneys in the account shall be expended for internal quality improvement activities in the Licensing and Certification Program.

(g) If the licensee disputes a determination by the department regarding a failure to prevent or failure to timely report unlawful or unauthorized access to, or use or disclosure of, patients’ medical information, or the imposition of a penalty under this section, the licensee may, within 10 days of receipt of the penalty assessment, request a hearing pursuant to Section 131071. Penalties shall be paid when appeals have been exhausted and the penalty has been upheld.

(h) In lieu of disputing the determination of the department regarding a failure to prevent or failure to timely report unlawful or unauthorized access to, or use or disclosure of, patients’ medical information, transmit to the department 75 percent of the total amount of the administrative penalty, for each violation, within 30 business days of receipt of the administrative penalty.

(i) For purposes of this section, the following definitions shall apply:

(1) “Reported event” means all breaches included in any a single report that is made pursuant to subdivision (b), regardless of the number of breach events contained in the report.

(2) “Unauthorized” means the inappropriate access, review, or viewing of patient medical information without a direct need for medical diagnosis, treatment, or other lawful use as permitted by the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) or any other statute or regulation governing the lawful access, use, or disclosure of medical information.

123605.

 (a) Each county shall establish protocols between county health departments, county welfare departments, and all public and private hospitals in the county, regarding the application and use of an assessment of the needs of, and a referral for, a substance exposed infant to a county welfare department pursuant to Section 11165.13 of the Penal Code.

(b) The assessment of the needs shall be performed by a health practitioner, as defined in Section 11165.8 paragraphs (21) to (28), inclusive, of subdivision (a) of Section 11165.7 of the Penal Code, or a medical social worker. The needs assessment shall be performed before the infant is released from the hospital.

(c) The purpose of the assessment of the needs is to do all of the following:

(1) Identify needed services for the mother, child, or family, including, where applicable, services to assist the mother caring for her child and services to assist maintaining children in their homes.

(2) Determine the level of risk to the newborn upon release to the home and the corresponding level of services and intervention, if any, necessary to protect the newborn’s health and safety, including a referral to the county welfare department for child welfare services.

(3) Gather data for information and planning purposes.

11165.13.

 (a) For purposes of this article, a positive toxicology screen at the time of the delivery of an infant is not in and of itself a sufficient basis for reporting child abuse or neglect. However, any an indication of maternal substance abuse shall lead to an assessment of the needs of the mother and child pursuant to Section 123605 of the Health and Safety Code. If other factors are present that indicate risk to a child, then a report shall be made. made, subject to the limitations contained in subdivision (b). However, a report based on risk to a child which relates solely to the inability of the parent to provide the child with regular care due to the parent’s substance abuse shall be made only to a county welfare or probation department, and not to a law enforcement agency.