Individual notice deadline
Within 30 calendar days of discovery or notification of the breach, subject to the specified law-enforcement delay and any delay reasonably necessary to determine the scope of the breach and restore reasonable integrity to the data system.
The outer bound of 30 days is materially shorter than HIPAA's 60-day individual-notice window. Federal and state duties apply independently.
Source: Cal. Civ. Code § 1798.82(a)(2)(A)–(B) (as amended by SB 446, effective January 1, 2026)
Statewide rules that also reach independent medical practices
Minor may consent
Subject to the limitations provided in the chapter, and notwithstanding any other provision of law, a minor may consent to the matters provided in the chapter, and the consent of the minor's parent or guardian is not necessary. A consent given by a minor under the chapter is not subject to disaffirmance because of minority.
What this means operationally
The frame the rest of the California chapter hangs on, and the reason each later section can be read as a self-contained route rather than as an exception to a general rule of parental consent. Non-disaffirmance matters commercially as well as clinically: the minor's consent cannot later be undone on the ground that they were a minor when they gave it.
Applies when
- The matter is one the chapter provides for
Exceptions
- Each section carries its own limitations
Minor may consent
A minor may consent to the minor's medical care, vision care, or dental care if the minor is 15 years of age or older, is living separate and apart from the minor's parents or guardian — whether or not with their consent and regardless of how long the separate residence has lasted — and is managing the minor's own financial affairs, regardless of the source of income.
What this means operationally
The California route that reaches a dental chair and an optometry lane rather than only a clinic. Vision care and optometrists were added by SB 457 in 2023, so an optometry practice working from pre-2024 guidance will not find itself in the older text. All three conditions must hold together, and none of them is about maturity — this is a status test a practice can actually ask about.
Applies when
- The minor is 15 or older
- The minor lives separate and apart from a parent or guardian
- The minor manages their own financial affairs
Payment liability
The parents or guardian are not liable for medical care, vision care, or dental care provided to a minor under § 6922.
What this means operationally
Flat, with no participation exception — unlike the mental-health and substance-use sections of the same chapter, where a participating parent does become liable. So the guarantor answer in California depends on which section the minor consented under, and a single default rule across the chapter will be wrong somewhere.
Applies when
- The care was provided on the minor's consent under § 6922
Release prohibited
The REPRESENTATIVE OF A MINOR shall NOT be entitled to inspect or obtain copies of the minor's patient records, INCLUDING CLINICAL NOTES, in any of three circumstances: where the minor has a right of inspection in their own name under § 123110; where the health care provider DETERMINES that access by the representative would have a DETRIMENTAL EFFECT ON THE PROVIDER'S PROFESSIONAL RELATIONSHIP with the minor patient, or on the minor's PHYSICAL SAFETY OR PSYCHOLOGICAL WELL-BEING; or where the records relate to services described in Family Code §§ 6924, 6925, 6926, 6927, 6928, 6929 or 6930, or Health & Safety Code §§ 121020 or 124260, when obtained by a patient who HAS THE MENTAL CAPACITY TO PROVIDE CONSENT and is AT OR ABOVE THE MINIMUM AGE for consenting to that service. The provider's decision as to whether a minor's records are available for inspection or copying SHALL NOT ATTACH ANY LIABILITY to the provider UNLESS THE DECISION IS FOUND TO BE IN BAD FAITH.
What this means operationally
This is the records-side consequence of California's minor-consent statutes and it should be read together with them: where a minor could lawfully consent to the care, the parent is not entitled to the record of it. The second limb is broader than practices expect because it is not confined to safety — a detrimental effect on the PROVIDER'S PROFESSIONAL RELATIONSHIP with the minor is sufficient on its own. The liability shield is unusually strong and cuts both ways: a good-faith decision either way is protected, so the risk of deciding is low and the risk of having no decision process is higher.
Applies when
- A parent or other representative of a minor requests the minor’s patient records
Exceptions
- The provider’s determination attracts no liability unless made in bad faith
Deadline to respond to an access request
Any ADULT patient of a health care provider, any MINOR PATIENT AUTHORIZED BY LAW TO CONSENT to medical treatment, and any patient's PERSONAL REPRESENTATIVE shall be entitled to INSPECT patient records upon presenting a request and upon payment of reasonable costs. A patient who is a minor is entitled to inspect patient records pertaining ONLY to health care of a type for which the minor is lawfully authorized to consent. A health care provider shall permit this inspection DURING BUSINESS HOURS WITHIN FIVE WORKING DAYS after receipt of the request. The inspection shall be conducted by the patient or personal representative requesting it, who MAY BE ACCOMPANIED BY ONE OTHER PERSON of their choosing.
What this means operationally
California separates INSPECTION from COPYING and gives them different clocks — five working days to let someone look, fifteen days to send a copy. A practice running a single records-request workflow will miss the shorter one. Two details are easy to overlook: the requester may bring one companion of their choosing, which is a right rather than a courtesy, and a minor's own inspection right is bounded by the care they could have consented to, so the scope of the record they may see is determined by the consent statutes rather than by age alone.
Applies when
- An adult patient, a minor patient authorized to consent to the care in question, or a personal representative requests inspection
Exceptions
- Subject to §§ 123115 and 123120, and to Welf. & Inst. Code § 5328
- A minor may inspect only records of care they were lawfully authorized to consent to
Deadline to respond to an access request
Any patient or patient's personal representative shall be entitled to a PAPER OR ELECTRONIC COPY of all or any portion of the patient records they have a right to inspect, upon presenting a request specifying the records to be copied together with the fee. The health care provider shall ensure that the copies are TRANSMITTED WITHIN 15 DAYS after receiving the request. The provider shall provide the record IN THE FORM AND FORMAT REQUESTED if it is READILY PRODUCIBLE in that form and format, or if not, in a readable paper copy form or other form and format AS AGREED between provider and requester. If the requested records are MAINTAINED ELECTRONICALLY and an electronic copy is requested, the provider shall provide them in the electronic form and format requested if readily producible, or if not, in a readable electronic form and format as agreed.
What this means operationally
Fifteen days, and note it is fifteen CALENDAR days against five WORKING days for inspection, so the two clocks can invert in a holiday week. The format rule is the operative one for practices with modern systems: where records are held electronically and an electronic copy is asked for, the fallback is another ELECTRONIC format, not paper. A practice that answers an electronic request with a printout has not complied unless paper was agreed. Readily producible is the test, and it is about the system's actual capability rather than the practice's preference.
Applies when
- A patient or personal representative requests copies of records they are entitled to inspect
Exceptions
- Subject to §§ 123115 and 123120
- X-rays and tracings are governed separately by § 123110(c)
Parental right of access
A patient, an EMPLOYEE OF A NONPROFIT LEGAL SERVICES ENTITY representing the patient, or the personal representative, is entitled to a copy AT NO CHARGE of the relevant portion of the patient's records, upon presenting a written request and PROOF that the records are needed to support a claim or appeal regarding ELIGIBILITY FOR A PUBLIC BENEFIT PROGRAM, a petition for U NONIMMIGRANT STATUS under the Victims of Trafficking and Violence Protection Act, or a SELF-PETITION FOR LAWFUL PERMANENT RESIDENCY under the Violence Against Women Act. A public benefit program includes Medi-Cal, In-Home Supportive Services, CalWORKs, Social Security Disability Insurance, SSI/SSP, federal veterans service-connected compensation and nonservice-connected pension disability benefits, CalFresh, the Cash Assistance Program for Aged, Blind and Disabled Legal Immigrants, and a government-funded housing subsidy or tenant-based housing assistance program. The patient is not limited to a single request but is entitled to NO MORE THAN ONE free copy of any relevant portion. Where a record is requested on this basis the provider shall ensure copies are TRANSMITTED WITHIN 30 DAYS.
What this means operationally
A third deadline in the same section, and the longest of the three — thirty days, against fifteen for an ordinary copy. The trade is that the copy is free and the trigger is documentary: the requester must present PROOF the records support one of the listed claims. The carve-out matters commercially: it does not apply where the patient is represented by a PRIVATE attorney paying the costs of the claim, so a practice may ask who is funding the matter. Note the free-copy entitlement is once per relevant portion, not once overall, so a second request covering different records still qualifies.
Applies when
- A written request with proof that records support a public-benefit claim or appeal, a U-visa petition, or a VAWA self-petition
Exceptions
- Does not apply where the patient is represented by a private attorney paying the costs related to the claim or appeal
- No more than one free copy of any relevant portion of the record
Parental right of access
This section PROHIBITS a health care provider from WITHHOLDING patient records or summaries of patient records BECAUSE OF AN UNPAID BILL FOR HEALTH CARE SERVICES. Any health care provider who wilfully withholds patient records or summaries because of an unpaid bill is subject to the sanctions specified in subdivision (h) — for the enumerated individual professions, being guilty of UNPROFESSIONAL CONDUCT, and for facilities, clinics and home health agencies an INFRACTION punishable by a fine of not more than one hundred dollars. The licensing agency, board or commission shall consider a violation as GROUNDS FOR DISCIPLINARY ACTION including SUSPENSION OR REVOCATION of the license.
What this means operationally
The prohibition reaches summaries as well as records, so a practice cannot route around it by offering a summary and holding that back too. Note what it does not say: it bars withholding over an unpaid bill for HEALTH CARE SERVICES, and it does not disturb the separate copying fee that subdivision (j) permits, which the statute treats as payable before copies issue. The consequence is license-level rather than contractual — wilful withholding is unprofessional conduct for a dentist, optometrist, chiropractor or physical therapist just as for a physician, and the board is directed to treat it as grounds for discipline.
Applies when
- A patient or personal representative has requested records or a summary and owes money for health care services
Exceptions
- The reasonable cost-based copying fee under § 123110(j) is unaffected
Deadline to respond to an access request
A health care provider MAY PREPARE A SUMMARY of the record for inspection and copying INSTEAD OF allowing access to the entire record. If the provider chooses to do so, it shall make the summary available to the patient WITHIN 10 WORKING DAYS from the date of the request. However, if MORE TIME IS NEEDED because the record is of EXTRAORDINARY LENGTH or because the patient was DISCHARGED FROM A LICENSED HEALTH FACILITY WITHIN THE LAST 10 DAYS, the provider shall NOTIFY THE PATIENT of this fact and the date the summary will be completed, but IN NO CASE shall more than 30 DAYS elapse between the request and delivery. In preparing the summary the provider is not obliged to include information not contained in the original record. The summary shall contain, for each injury, illness or episode: chief complaints including pertinent history; findings from consultations and referrals; diagnosis where determined; treatment plan and regimen including medications prescribed; progress of treatment; prognosis including significant continuing problems or conditions; pertinent reports of diagnostic procedures and tests and all discharge summaries; and objective findings from the most recent physical examination. The summary shall also contain a LIST OF ALL CURRENT MEDICATIONS PRESCRIBED, including dosage, and ANY SENSITIVITIES OR ALLERGIES to medications recorded by the provider. The provider may charge NO MORE THAN A REASONABLE FEE BASED ON ACTUAL TIME AND COST for preparation, computed on actual time spent, the Legislature's stated intent being that summaries be made available at the LOWEST POSSIBLE COST.
What this means operationally
The summary route is the provider's option, not the patient's, and it is usually a worse deal for the practice than simply copying the file: ten working days is a tighter clock than the fifteen calendar days for copies, the content list is prescriptive, and the fee is actual-time-based rather than per-page. It is worth using only where releasing the full record is genuinely inappropriate. The extension to thirty days is available on two stated grounds only and requires affirmative notice naming a completion date — silence does not extend anything. Note the provider may confer with the patient to narrow the request to particular episodes, which is the one feature that makes the route manageable.
Applies when
- A health care provider elects to prepare a summary rather than allow access to the entire record
Exceptions
- Extension to no more than 30 days where the record is of extraordinary length, or the patient was discharged from a licensed health facility within the last 10 days, and the patient is notified of the completion date
- Where the patient narrows the request to particular injuries, illnesses or episodes, the summary need cover only those
- X-rays and tracings continue to be governed by § 123110(c)
Limit on copy fees, format or delivery
Copies of X-RAYS or tracings derived from ELECTROCARDIOGRAPHY, ELECTROENCEPHALOGRAPHY or ELECTROMYOGRAPHY NEED NOT BE PROVIDED to the patient or personal representative, IF the ORIGINAL X-rays or tracings are transmitted to ANOTHER HEALTH CARE PROVIDER upon written request of the patient or personal representative and WITHIN 15 DAYS after receipt of the request. The request shall specify the name and address of the health care provider to whom the records are to be delivered. All reasonable costs, NOT EXCEEDING ACTUAL COSTS, incurred in providing copies under this subdivision may be charged to the requester. A provider may establish reasonable conditions, INCLUDING A REASONABLE DEPOSIT FEE, to ensure the return of original X-rays transmitted to another provider, provided the conditions do not discriminate on the basis of the receiving provider's license. Every health care provider shall ADOPT POLICIES AND ESTABLISH PROCEDURES for the uniform transmittal of X-rays and other patient records that effectively prevent such discrimination.
What this means operationally
This is a substitution right, not an exemption: the practice escapes copying imaging only by sending the ORIGINALS to a named provider inside fifteen days. Two obligations ride along that practices rarely operationalise. Costs here are capped at ACTUAL cost rather than the per-page schedule that governs ordinary copies, and a deposit may be required to get originals back — but the conditions may not discriminate by the receiving provider's license type, and the statute requires a WRITTEN POLICY establishing uniform transmittal procedures. That written policy is a compliance artefact most small practices do not have.
Applies when
- A patient or personal representative requests X-rays or ECG, EEG or EMG tracings
Limit on copy fees, format or delivery
A health care provider may impose a REASONABLE, COST-BASED FEE for providing a paper or electronic copy or summary of patient records, provided the fee includes ONLY the cost of: LABOR for copying the records, whether in paper or electronic form; SUPPLIES for creating the paper copy or electronic media if the requester asks that the electronic copy be provided on PORTABLE MEDIA; POSTAGE, if mailing was requested; and PREPARING AN EXPLANATION OR SUMMARY of the record, if agreed to by the patient or personal representative. The fee SHALL NOT EXCEED TWENTY-FIVE CENTS ($0.25) PER PAGE for paper copies or FIFTY CENTS ($0.50) PER PAGE for records copied from MICROFILM.
What this means operationally
The list is exhaustive and it is what makes California's fee genuinely cost-based rather than a schedule. Search time, retrieval, and administrative overhead are absent from it, so a practice billing a flat records-request handling fee is charging for something the statute does not permit. Supplies are recoverable only where the requester asked for portable media, and summary preparation only where the patient agreed to a summary. The per-page cap is a ceiling on the cost-based figure, not an entitlement — a provider whose actual cost is lower may not charge twenty-five cents.
Applies when
- A health care provider supplies a copy or summary of patient records
Exceptions
- Does not apply to a no-charge copy under § 123110(d)
- Actual-cost recovery under § 123110(c) governs X-rays and tracings instead
Right to amend or correct the record
A patient who inspects their patient records has the RIGHT TO PROVIDE the health care provider a WRITTEN ADDENDUM with respect to any item or statement in the records that the patient believes to be INCOMPLETE OR INCORRECT. The addendum shall be LIMITED TO 250 WORDS PER ALLEGED INCOMPLETE OR INCORRECT ITEM and shall clearly indicate IN WRITING that the patient requests the addendum be made part of the record. The health care provider SHALL ATTACH the addendum to the patient's records and SHALL INCLUDE THAT ADDENDUM if the provider makes a disclosure of the allegedly incomplete or incorrect portion to ANY THIRD PARTY. Receipt of information in a patient's addendum which contains DEFAMATORY OR OTHERWISE UNLAWFUL LANGUAGE, and its inclusion in the record, shall NOT IN AND OF ITSELF SUBJECT THE PROVIDER TO LIABILITY in any civil, criminal, administrative or other proceeding.
What this means operationally
California gives the patient a right to ADD, not a right to have the record changed — the disputed entry stays exactly as written and the patient's statement travels beside it. Two duties follow that are easy to miss. The addendum must be attached, and it must be SENT ONWARD whenever the disputed portion is disclosed to a third party, which makes it a permanent feature of every future release rather than a filing. The immunity clause exists because providers would otherwise refuse defamatory addenda: the practice is protected for including what the statute obliges it to include, so refusing on that ground is both unnecessary and non-compliant.
Applies when
- A patient has inspected their records under § 123110 and disputes an item as incomplete or incorrect
Exceptions
- Limited to 250 words per disputed item
- Must state in writing that the patient requests it be made part of the record
