Q: Requisite relationship. Definition and applicability.

A: Under California law, the hospital may be held liable for the actions of its employees and contractors who disclose patient records without authorization. When a computer technician employed by the hospital discloses patient records to a hospice without proper authorization, the hospital could be responsible for this breach of confidentiality, especially if the technician was acting within the scope of their employment. This liability arises from the hospital's duty to protect patient information under the California Confidentiality of Medical Information Act (CMIA).

In the case where a subcontractor physician orders the production of patient records after discharge, if those records are disclosed without authorization, the hospital's liability depends on whether the physician's actions are within the scope of their contractual relationship with the hospital. If the physician is acting on behalf of the hospital or within their role as a contractor, the hospital could still be held liable for the unauthorized disclosure.

However, if the hospital had no direct dealings or control over the subcontractor physician's actions, and if the physician acted independently and outside the scope of their relationship with the hospital, the hospital might not be held liable. Yet, the hospital could still face liability if it failed to implement adequate safeguards to prevent unauthorized disclosures. Each situation needs to be carefully examined to determine the extent of the hospital's responsibility under California law.