Q: what violation hospital is liable for in this situation?

A: Based on the situation you described, under California law, the hospital could be liable for several violations related to the unauthorized disclosure of the patient's medical records to a third party without proper authorization. Here are the key violations:

1. Confidentiality of Medical Information Act (CMIA) violation: The CMIA (Cal. Civ. Code §§ 56-56.37) prohibits healthcare providers from disclosing a patient's medical information without proper authorization. If the hospital disclosed the patient's records to a third party without a valid waiver or authorization, it would be in violation of the CMIA.

2. Breach of patient confidentiality: The unauthorized disclosure of the patient's medical records constitutes a breach of the patient's right to confidentiality, which is protected by state and federal laws, including the Health Insurance Portability and Accountability Act (HIPAA).

3. Failure to notify the patient of the breach: Under California law (Cal. Health & Safety Code § 1280.15) and HIPAA (45 CFR §§ 164.400-414), healthcare providers are required to notify patients of any unauthorized access, use, or disclosure of their protected health information. If the hospital failed to notify the patient of the unauthorized release of their records to a third party, it would be in violation of these breach notification requirements.

In summary, the hospital could be liable for violations of the CMIA, breach of patient confidentiality, and failure to notify the patient of the unauthorized disclosure of their medical records. The patient may have grounds to file a complaint with the California Department of Public Health and seek damages for the hospital's violations of their privacy rights.