Q: Statute: requirement to disclose to patient unauthorized disclosure of patient's records.

A: Under California law, there are two main statutes that require hospitals and healthcare providers to disclose unauthorized access or disclosure of a patient's medical records to the affected patient:

1. California Health and Safety Code Section 1280.15 (effective January 1, 2009):

This statute requires healthcare facilities, including hospitals, to prevent unlawful or unauthorized access, use, or disclosure of patients' medical information. If a breach occurs, the facility must report the incident to the affected patient or patients no later than 15 business days after the unlawful or unauthorized access, use, or disclosure has been detected.

2. California Civil Code Section 56.101 (part of the Confidentiality of Medical Information Act):

This statute requires healthcare providers to notify the affected patient in writing if there is an unauthorized disclosure of their medical information. The disclosure must be made within 15 business days of detecting the breach. The notification must include specifics about the information disclosed, the date of disclosure, and steps the patient can take to protect themselves from potential harm.

Both statutes aim to protect patient privacy and ensure that patients are promptly informed if their confidential medical records have been accessed or disclosed without proper authorization. Failure to comply with these notification requirements can result in significant fines and penalties for the healthcare facility or provider.