Q: What statute defines that hospital cannot obey order of subcontractor to disclose unauthorized info

A: Under California law, there are several statutes that protect patient privacy and prohibit hospitals from disclosing unauthorized information, even if ordered to do so by a subcontractor such as a doctor. The most relevant statutes are:

1. California Confidentiality of Medical Information Act (CMIA) (Civil Code §§ 56-56.37): This law prohibits healthcare providers, including hospitals, from disclosing medical information without the patient's authorization, except in certain limited circumstances. It applies even if a subcontractor directs the hospital to disclose the information.

2. California Patient Access to Health Records Act (Health & Safety Code §§ 123100-123149.5): This law gives patients the right to access their own medical records and restricts healthcare providers from disclosing those records without authorization.

3. California Health and Safety Code § 1280.15: This statute requires hospitals to prevent unlawful or unauthorized access to, or use or disclosure of, a patient's medical information.

4. California Welfare and Institutions Code § 5328: For mental health records, this statute prohibits disclosure of such information without the patient's authorization, except in certain circumstances.

Additionally, federal laws like the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR Part 160 and Subparts A and E of Part 164) also protect patient privacy and supersede any conflicting state laws that provide less protection.

So in summary, under California law, hospitals cannot obey an order from a subcontractor like a doctor to disclose patient records without authorization, even if the conditions of admission state that the hospital must follow the doctor's directions. The CMIA, Patient Access to Health Records Act, and other statutes prohibit such unauthorized disclosure and protect patient privacy.