Health facility reporting of unauthorized access to medical information
HSC 1280.15
Health · Breach notification
Requires licensed health facilities to prevent unauthorized access to patients' medical information and to report any unlawful or unauthorized access, use, or disclosure to the Department of Public Health and to the affected patient within 15 business days of detection.
- Where
- California
- Citation
- Cal. Health & Safety Code 1280.15
- Status
- In force
- In force since
- 2009-01-01
- Last amended
- 2025-06-30
- Enforced by
- California Department of Public Health
- People can sue
- No
- Penalties
- Administrative penalties up to $25,000 per patient whose information was unlawfully accessed, used, or disclosed, and up to $17,500 per subsequent occurrence; separate penalties for late reporting.
- Applies to
- Licensed clinics, health facilities (including hospitals), home health agencies, and hospices
Security duties
- Prevent unlawful or unauthorized access to, and use or disclosure of, patients' medical information.Cal. Health & Safety Code 1280.15(a)
Breach duties
- Report unauthorized access, use, or disclosure to the Department of Public Health within 15 business days after detection.Cal. Health & Safety Code 1280.15(b)(1)
- Notify the affected patient or representative within 15 business days after detection (delay allowed at law enforcement request).Cal. Health & Safety Code 1280.15(b)(2), (c)
Sources
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Original effective date (Jan. 1, 2009, SB 541) is from background knowledge. | Late-reporting penalty amount not extracted.
Research reference, not legal advice.