Cal. Health and Safety Code - HSC § 120440. Section 120440.
(a)
For the purposes of this chapter, the following definitions shall apply:
(1)
“Health care provider” means any person licensed pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code or a clinic or health facility licensed pursuant to Division 2 (commencing with Section 1200).
(2)
“Schools, childcare facilities, and family childcare homes” means those institutions referred to in subdivision (b) of Section 120335, regardless of whether they directly provide immunizations to patients or clients.
(3)
“WIC service provider”
means any public or private nonprofit agency contracting with the department to provide services under the California Special Supplemental Nutrition Program for Women, Infants, and Children, as provided for in Article 2 (commencing with Section 123275) of Chapter 1 of Part 2 of Division 106.
(4)
“Health care plan” means a health care service plan as defined in subdivision (f) of Section 1345, a government-funded program the purpose of which is paying the costs of health care, or an insurer as described in Sections 10123.5 and 10123.55 of the Insurance Code, regardless of whether the plan directly provides immunizations to patients or clients.
(5)
“County human services agency” means a county welfare agency administering the California Work Opportunity and
Responsibility to Kids (CalWORKs) program, pursuant to Chapter 2 (commencing with Section 11200.5) of Part 3 of Division 9 of the Welfare and Institutions Code.
(6)
“Foster care agency” means any of the county and state social services agencies providing foster care services in California.
(7)
“Tuberculosis screening” means an approved intradermal tuberculin test or any other test for tuberculosis infection that is recommended by the federal Centers for Disease Control and Prevention and licensed by the federal Food and Drug Administration.
(b)
(1)
Local health officers may operate immunization information systems pursuant to their authority under Section 120175, in conjunction with
the Immunization Branch of the State Department of Public Health. Local health officers and the State Department of Public Health may operate these systems in either or both of the following manners:
(A)
Separately within their individual jurisdictions.
(B)
Jointly among more than one jurisdiction.
(2)
This subdivision does not preclude local health officers from sharing the information set forth in paragraphs (1) to (13), inclusive, of subdivision (c) with other health officers jointly operating the system.
(c)
Notwithstanding Sections 49075 and 49076 of the Education Code, Chapter 5 (commencing with Section 10850) of Part 2 of Division 9 of the Welfare and
Institutions Code, or any other law, unless a refusal to permit recordsharing is made pursuant to subdivision (e), health care providers, and other agencies, including, but not limited to, schools, childcare facilities, service providers for the California Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), health care plans, foster care agencies, and county human services agencies, shall disclose the information set forth in paragraphs (1) to (13), inclusive, from the patient’s medical record, or the client’s record, to local health departments operating countywide or regional immunization information and reminder systems and the State Department of Public Health. With respect to the information set forth in paragraph (13), a health care provider is only required to disclose information that is voluntarily provided by the patient or client. A health care provider shall
not disclose any information set forth in paragraph (13) relating to any patient or client who is under 18 years of age. Local health departments and the State Department of Public Health may disclose the information set forth in paragraphs (1) to (13), inclusive, to each other and, upon a request for information pertaining to a specific person, to health care providers taking care of the patient and to the Medical Board of California and the Osteopathic Medical Board of California. Local health departments and the State Department of Public Health may disclose the information in paragraphs (1) to (7), inclusive, and paragraphs (9) to (12), inclusive, to schools, childcare facilities, county human services agencies, and
family childcare homes to which the person is being admitted or in attendance, foster care agencies in assessing and providing medical care for children in foster care, and WIC service providers providing services to the person, health care plans arranging for immunization services for the patient, and county human services agencies assessing immunization histories of dependents of CalWORKs participants, upon request for information pertaining to a specific person. Determination of benefits based upon immunization of a dependent CalWORKs participant shall be made pursuant to Section 11265.8 of the Welfare and Institutions Code. The following information shall be subject to this subdivision:
(1)
The name of the patient or client and names of the parents or guardians of the patient or client.
(2)
Date of birth of the patient or client.
(3)
Types and dates of immunizations received by the patient or client.
(4)
Manufacturer and lot number for each immunization received.
(5)
Adverse reaction to immunizations received.
(6)
Other nonmedical information necessary to establish the patient’s or client’s unique identity and record.
(7)
Results of tuberculosis screening.
(8)
Current address and telephone number of the patient or client and the parents or guardians of the patient or client.
(9)
Patient’s or client’s gender.
(10)
Patient’s or client’s place of birth.
(11)
Patient’s or client’s race and ethnicity.
(12)
Patient’s or client’s information needed to comply with Chapter 1 (commencing with Section 120325), but excluding Section 120380.
(13)
An adult patient’s or client’s sexual orientation, gender identity, and variations in sex characteristics/intersex status
(SOGISC) and sex assigned at birth.
(d)
(1)
Health care providers, local health departments, and the State Department of Public Health shall maintain the confidentiality of information listed in subdivision (c) in the same manner as other medical record information with patient identification that they possess. These providers, departments, and contracting agencies are subject to civil action and criminal penalties for the wrongful disclosure of the information listed in subdivision (c), in accordance with existing law. They shall use the information listed in subdivision (c) only for the following purposes:
(A)
To provide immunization services to the patient or client, including issuing reminder notifications to patients or
clients or their parents or guardians when immunizations are due.
(B)
To provide or facilitate provision of third-party payer payments for immunizations.
(C)
To compile and disseminate statistical information of immunization status on groups of patients or clients or populations in California, without identifying information for these patients or clients included in these groups or populations.
(D)
In the case of health care providers only, as authorized by Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code.
(2)
Schools, childcare facilities, family childcare homes, WIC service providers, foster care agencies, county human services agencies,
and health care plans shall maintain the confidentiality of information listed in subdivision (c) in the same manner as other client, patient, and pupil information that they possess. These institutions and providers are subject to civil action and criminal penalties for the wrongful disclosure of the information listed in subdivision (c), in accordance with existing law. They shall use the information listed in subdivision (c) only for those purposes provided in subparagraphs (A) to (D), inclusive, of paragraph (1) and as follows:
(A)
In the case of schools, childcare facilities, family childcare homes, and county human services agencies, to carry out their responsibilities regarding required immunization for attendance or participation benefits, or both, as described in Chapter 1 (commencing with Section 120325), and in Section 11265.8 of the
Welfare and Institutions Code.
(B)
In the case of WIC service providers, to perform immunization status assessments of clients and to refer those clients found to be due or overdue for immunizations to health care providers.
(C)
In the case of health care plans, to facilitate payments to health care providers, to assess the immunization status of their clients, and to tabulate statistical information on the immunization status of groups of patients, without including patient-identifying information in these tabulations.
(D)
In the case of foster care agencies, to perform immunization status assessments of foster children and to assist those foster children found to be due or overdue for immunization in obtaining immunizations
from health care providers.
(e)
A patient or a patient’s parent or guardian may refuse to permit recordsharing. The health care provider administering immunization and any other agency possessing any patient or client information listed in subdivision (c), if planning to provide patient or client information to an immunization system, as described in subdivision (b), shall inform the patient or client, or the parent or guardian of the patient or client, of the following:
(1)
The information listed in subdivision (c) shall be shared with local health departments and the State Department of Public Health, except as prohibited by this section or other applicable law. The health care provider or other agency shall provide the name and address of the State Department of Public Health or of the
immunization registry with which the provider or other agency will share the information.
(2)
Any of the information shared with local health departments and the State Department of Public Health shall be treated as confidential medical information and shall be used only to share with each other, and, upon request, with health care providers, schools, childcare facilities, family childcare homes, WIC service providers, county human services agencies, foster care agencies, and health care plans. These providers, agencies, and institutions shall, in turn, treat the shared information as confidential, and shall use it only as described in subdivision (d).
(3)
The patient or client, or parent or guardian of the patient or client, has the right to examine any immunization-related information
or tuberculosis screening results shared pursuant to this section and to correct any errors in it.
(4)
The patient or client, or the parent or guardian of the patient or client, may refuse to allow this information to be shared pursuant to this section or to receive immunization reminder notifications at any time, or both. After refusal, the patient’s or client’s physician may maintain access to this information for the purposes of patient care or protecting the public health. After refusal, the local health department and the State Department of Public Health may maintain access to this information for the purpose of protecting the public health pursuant to Sections 100325, 120140, and 120175, as well as Sections 2500 to 2643.20, inclusive, of Title 17 of the California Code of Regulations.
(f)
(1)
The health care provider administering the immunization or tuberculosis screening and any other agency possessing any patient or client information listed in subdivision (c), may inform the patient or client, or the parent or guardian of the patient or client, by ordinary mail, of the information in paragraphs (1) to (4), inclusive, of subdivision (e). The mailing shall include a reasonable means for refusal, such as a return form or contact telephone number.
(2)
The information in paragraphs (1) to (4), inclusive, of subdivision (e) may also be presented to the parent or guardian of the patient or client during any hospitalization of the patient or client.
(g)
If the patient or client, or parent or guardian of the patient or client,
refuses to allow the information to be shared, pursuant to paragraph (4) of subdivision (e), the health care provider or other agency may not share this information in the manner described in subdivision (c), except as provided in subparagraph (D) of paragraph (1) of subdivision (d).
(h)
(1)
Upon request of the patient or client, or the parent or guardian of the patient or client, in writing or by other means acceptable to the recipient, a local health department or the State Department of Public Health that has received information about a person pursuant to subdivision (c) shall do all of the following:
(A)
Provide the name and address of other persons or agencies with whom the recipient has shared the information.
(B)
Stop sharing the information in its possession after the date of the receipt of the request.
(2)
After refusal, the patient’s or client’s physician may maintain access to this information for the purposes of patient care or protecting the public health. After refusal, the local health department and the State Department of Public Health may maintain access to this information for the purpose of protecting the public health pursuant to Sections 100325, 120140, and 120175, as well as Sections 2500 to 2643.20, inclusive, of Title 17 of the California Code of Regulations.
(i)
Upon notification, in writing or by other means acceptable to the recipient, of an error in the information, a local health department or the State Department of Public Health that has information
about a person pursuant to subdivision (c) shall correct the error. If the recipient is aware of a disagreement about whether an error exists, information to that effect may be included.
(j)
(1)
Any party authorized to make medical decisions for a patient or client, including, but not limited to, those authorized by Section 6922, 6926, or 6927 of, Part 1.5 (commencing with Section 6550), Chapter 2 (commencing with Section 6910) of Part 4, or Chapter 1 (commencing with Section 7000) of Part 6, of Division 11 of, the Family Code, Section 1530.6 of the Health and Safety Code, or Sections 727 and 1755.3 of, and Article 6 (commencing with Section 300) of Chapter 2 of Part 1 of Division 2 of, the Welfare and Institutions Code, may permit sharing of the patient’s or client’s record with any of the immunization information systems
authorized by this section.
(2)
For a patient or client who is a dependent of a juvenile court, the court or a person or agency designated by the court may permit this recordsharing.
(3)
For a patient or client receiving foster care, a person or persons licensed to provide residential foster care, or having legal custody, may permit this recordsharing.
(k)
For purposes of supporting immunization information systems, the State Department of Public Health shall assist the Immunization Branch of the State Department of Public Health in both of the following:
(1)
Providing department records containing information about publicly funded immunizations.
(2)
Supporting efforts for the reporting of publicly funded immunizations into immunization information systems by health care providers and health care plans.
(
l
)
Subject to any other provisions of state and federal law or regulation that limit the disclosure of health information and protect the privacy and confidentiality of personal information, local health departments and the State Department of Public Health may share the information listed in paragraphs (1) to (12), inclusive, of subdivision (c) with a state, local health departments, health care providers, immunization information systems, or any representative of an entity designated by federal or state law or
regulation to receive this information.
Information in paragraph (13) of subdivision (c) shall not be shared beyond the parties specified for sharing in subdivision (c). The State Department of Public Health may enter into written agreements to exchange confidential immunization information with other states for the purposes of patient care, protecting the public health, entrance into school, childcare and other institutions requiring immunization prior to entry, and the other purposes described in subdivision (d). The written agreement shall provide that the state that receives confidential immunization information must maintain its confidentiality and may only use it for purposes of patient care, protecting the public health, entrance into school, childcare and other institutions requiring immunization prior to entry, and the other purposes described in subdivision (d). Information shall not be shared pursuant to
this subdivision if a patient or client, or parent or guardian of a patient or client, refuses to allow the sharing of immunization information pursuant to subdivision (e).
(m)
This section shall become operative on January 1, 2026.