Q: CMIA statute. Requirement to notify affected patient about unauthorized disclosure of records.

A: Under the California Confidentiality of Medical Information Act (CMIA), the specific statute that requires a health care provider to notify the affected patient about unauthorized disclosure of patient's records is California Civil Code Section 56.36(a). The statute states:

"Any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall be subject to the remedies and penalties provided under subdivisions (b) and (c) of Section 56.35."

Furthermore, California Civil Code Section 56.35(a) states:

"In addition to any other remedies available at law, a patient whose medical information has been used or disclosed in violation of Section 56.10 or 56.104 or 56.20 or subdivision (a) of Section 56.26 and who has sustained economic loss or personal injury therefrom may recover compensatory damages, punitive damages not to exceed three thousand dollars ($3,000), attorneys' fees not to exceed one thousand dollars ($1,000), and the costs of litigation."

Therefore, when a health care provider negligently discloses a patient's medical information without authorization, they are required to notify the affected patient about the breach, as per California Civil Code Section 56.36(a). Failure to do so may result in the patient being entitled to the remedies and penalties outlined in Section 56.35, which include compensatory damages, punitive damages, attorneys' fees, and the costs of litigation.