This All Facilities Letter is being sent to inform you of recently chaptered legislation. SB 337 (Alquist, 2009) amended Section 1280.15 of the Health and Safety Code (HSC) with regard to the reporting of unlawful or unauthorized access to, or use or disclosure of, a patient's medical information by specified health care facilities. SB 337 clarifies the existing reporting requirements of "five days" to mean "five business days" and establishes an allowance for health facilities to delay reporting to the affected patient upon request by law enforcement. Effective January 1, 2010, HSC Section 1280.15 (b) requires a clinic, health facility, home health agency, or hospice to report any unlawful or unauthorized access to, or use or disclosure of, a patient's medical information to the department and to the patient or patient's representative, no later than five business days after the unlawful or

unauthorized access, use, or disclosure has been detected by the clinic, health facility, home health agency, or hospice. Additionally, pursuant to Section 1280.15 (c)(1) effective January 1, 2010, a clinic, health facility, home health agency, or hospice shall delay the reporting to the affected

patient or patient's representative of any unlawful or unauthorized access to, or use or disclosure of, a patient's medical information beyond five business days if a law enforcement agency or official provides the clinic, health facility, home health agency, or hospice with a written or oral statement that compliance with the five business day reporting requirement would be likely to impede the law enforcement agency's activities that relate to the unlawful or unauthorized access to, and use or disclosure of, a patient's medical information and specifies a date upon which the delay shall end, not to

exceed 60 days after a written request is made, or 30 days after an oral request is made. A law enforcement agency or official may request an extension of a delay based upon a written declaration that there exists a bona fide, ongoing, significant criminal investigation of serious wrongdoing relating to the unlawful or unauthorized access to, and use or disclosure of, a patient's medical information, that notification of patients will undermine the law enforcement agency's activities, and that specifies a date upon which the delay shall end, not to exceed 60 days after the end of the original delay

period. Facilities are responsible for following all applicable laws. California Department of Public Health's failure to expressly notify facilities of legislative changes does not relieve facilities of their responsibility for following all laws and regulations. Facilities should refer to the full text of SB 337 and HSC Section 1280.15 to ensure compliance.

Sincerely,

Original Signed by Kathleen Billingsley, R.N.

Kathleen Billingsley, R.N.
Deputy Director
Center for Health Care Quality