Defendant's non-disclosure of investigation results of fraud

Question

If  
investigation of unauthorized disclosure of patient's data to hospice by IT professionals was performed by hospital after plaintiff filed legal case alleging violation of CMIA (non-authorized release of records); 
did Defendant have liability to disclose to Plaintiff results of investigation and apologize? 
What statute defines this obligation? 
Does Defendant's non-disclosure of investigation results mean de facto endorsement?

James L. Arrasmith · Answer

Under California law, there are a few key considerations regarding a defendant's obligations to disclose investigation results related to alleged unauthorized disclosure of patient data: 
 
1. CMIA Requirements: The Confidentiality of Medical Information Act (CMIA) requires health care providers to maintain the confidentiality of patient medical information. If there is an unauthorized disclosure, the health care provider must notify the affected patient of the breach (Civil Code Section 56.36). However, the CMIA does not explicitly require disclosure of internal investigation results. 
 
2. Discovery Obligations: If the plaintiff has filed a legal case, the defendant may be obligated to disclose relevant information, including investigation results, through the discovery process. The Code of Civil Procedure governs discovery obligations, particularly Sections 2016.010-2036.050. The plaintiff can request the investigation results through interrogatories, requests for production, or depositions. 
 
3. Apology Law: California's "apology law" (Evidence Code Section 1160) allows healthcare providers to express sympathy, benevolence, or regret to a patient without it being used as an admission of liability. However, this law does not mandate an apology or disclosure of investigation results. 
 
4. Endorsement of Misconduct: Non-disclosure of investigation results does not necessarily equate to an endorsement of misconduct. The defendant may have various reasons for not disclosing the results, such as maintaining attorney-client privilege or protecting confidential information. However, failure to disclose relevant information during discovery could lead to sanctions. 
 
In summary, while the CMIA requires notification of a data breach, it does not explicitly mandate disclosure of internal investigation results or an apology. The defendant's obligation to disclose such information would likely arise during the discovery process in the legal case. Non-disclosure alone does not necessarily imply endorsement of misconduct, but withholding relevant information during discovery could have legal consequences.

Q: Defendant's non-disclosure of investigation results of fraud