The section provides immunity to consultants who communicate with the Director of the Department of Managed Health Care for the purpose of determining whether health care services are being provided in accordance with the Knox-Keene Act of 1975. Nothing in the code section alters existing laws regarding the confidentiality of medical records.
Any business organized for the purpose of maintaining medical information in order to make the information available to the patient or to a provider of health care [upon request], for purposes of diagnosis or treatment of the patient, shall be deemed to be a provider of health care and shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the corporation.
No provider of health care, health care service plan, or contractor shall disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as provided in subdivision (b) or (c).
A provider of health care, a health care service plan, or a contractor shall disclose medical information if the disclosure is compelled by any of the following: Court order; Order from a board, commission, or agency; Subpoena from a party before a court or agency; Arbitrator or panel; Search Warrant; Patient or Patient's representative; or, Coroner conducting an investigation
No provider of health care, health care service plan, or contractor may require a patient, as a condition of receiving health care services, to sign an authorization, release, consent, or waiver that would permit the disclosure of medical information that otherwise may not be disclosed.
In order to contract with the department the independent medical review organization must demonstrate that it has a quality assurance mechanism in place that ensures the confidentiality of medical records and the review materials that is consistent with the requirements of applicable laws.
A disease management organization shall not use medical information obtained pursuant to 1399.903, to solicit or to offer products or services to a health care services plan enrollee.
Confidential medical information may be shared between the home health agency and the residential care facility for the elderly relative to the client's medical condition and the care and treatment provided to the client by the home health agency.
Individuals may request correction, amendment or deletion of recorded personal information held by insurance institutions, agents or insurance-support organizations. If the insurance entity changes the information, it must notify the individual, and must communicate the changes to persons specifically designated, who may have received the information within the past two years.
Disclosure for marketing purposes of insurance related medical records is permissible as long as the subject is given an opportunity to refuse and consents with written authorization. The information's recipient must also agree to use the medical information solely for marketing purposes. Materials disclosed that include the individual's identity are to be returned or destroyed after use.
