CALIFORNIA DEPARTMENT OF CORRECTIONS AND REHABILITATION
CALIFORNIA CORRECTIONAL HEALTH CARE SERVICES
Health Care Department Operations Manual
Chapter 2, Article 3
2.3.4 Release of Protected Health Information Page 1 of 6
2.3.4 Release of Protected Health Information
(a) Policy
California Correctional Health Care Services (CCHCS) shall release requested Protected Health Information (PHI) with
authorization in accordance with applicable law, timely evaluation, and appropriate processing.
(b) Purpose
To provide guidance regarding the required criteria for handling and responding to routine requests for release of PHI
for purposes other than treatment payment and health care operations, and where required or permitted by law.
(c) Applicability
(1) This policy applies to the release of PHI in any form (health records, other types of written communication, and
verbal information) pursuant to a valid authorization, court order, administrative order, or subpoena.
(2) This policy does not apply to disclosures permitted by law in which a patient authorization is not required for release
of information. Refer to the Health Care Department Operations Manual (HCDOM) Section 2.2.6, Use and
Disclosure of Protected Health Information: Special Exceptions for these special situations.
(d) Responsibility
(1) Statewide
(A) Under the direction of the Deputy Director, Medical Services, and Health Information Management (HIM)
Chief:
1. Institution Health Records staff, within the scope of their authority, are responsible for oversight,
implementation, monitoring, and evaluation of this policy for current patients.
2. Health and Imaging Record Center (HIRC) staff, within the scope of their authority, are responsible for
oversight, implementation, monitoring, and evaluation of this policy for paroled or discharged people.
3. Health Records staff at institutions (for currently incarcerated people), and HIRC staff (for paroled and
discharged people) are responsible for processing all other requests for health information.
(2) Regional
Health Care Executives are responsible for the administration of this policy at the subset of institutions within their
assigned region.
(3) Institutional
The Chief Executive Officer (CEO), or designee, of each institution has the overall responsibility for
implementation and ongoing oversight of this policy.
(4) CCHCS workforce members shall ensure compliance with this policy and federal and state privacy laws containing
protections and additional restrictions for the access, use or disclosure of PHI.
(e) Procedure
(1) Routine Authorization
(A) Workforce members shall respond to a valid written authorization for release of PHI. CCHCS shall accept either
the CDCR 7385, Authorization for Release of Protected Health Information, or an alternative form that
conforms to the requirements of Section (e)(4) below.
(B) For access purposes, patient representatives shall be treated in the same manner as the patient who is the subject
of the health information unless there is an exception set forth in (e)(6)(B)(3) below.
(2) Court Orders, Administrative Order or Subpoena
(A) Workforce members shall comply with all properly executed court orders, administrative orders, or subpoena
in accordance with section (e)(6) and (e)(7) as follows:
1. If a court order, administrative order, or subpoena arrives at an institution through the Litigation
Coordinators, it shall be transmitted to HIM for record collection.
a. Unless otherwise advised by Legal Counsel, CCHCS shall comply with a subpoena that is not
accompanied by a court order compelling disclosure of PHI if:
1) CCHCS receives satisfactory assurances from the party seeking the PHI that the patient has
received notice of the subpoena, or a good faith effort has been made to provide the patient with
notice of the subpoena, in the form of a written statement and accompanying documentation
demonstrating that:
CALIFORNIA DEPARTMENT OF CORRECTIONS AND REHABILITATION
CALIFORNIA CORRECTIONAL HEALTH CARE SERVICES
Health Care Department Operations Manual
Chapter 2, Article 3 2.3.4 Release of Protected Health Information Page 2 of 6
a) The party requesting such information has made a good faith attempt to provide written notice
to the patient (or if the patient’s location in unknown, to mail a notice to the patient’s last known
address);
b) The notice included sufficient information about the litigation or proceeding in which the PHI
is requested to permit the patient to raise an objection to the court or the administrative tribunal;
and
c) The time for the patient to raise objections to the court or administrative tribunal has elapsed,
and there were either no objections filed, or all objections filed by the patient have been
resolved by the court or the administrative tribunal and the disclosures being sought are
consistent with such resolution; or
2) A qualified protective order has been agreed to by the parties and issued by the jurisdictional court.
2. If a court order, administrative order, or subpoena arrives at CCHCS headquarters, and validity of these
documents is in question, then HIRC staff shall collaborate with the Health Care Litigation Support Section,
when necessary, to ensure proper review, and determination of validity.
(3) Special Authorization
(A) Specially Protected Health Information
1. Patients must specifically authorize the release of the following specially protected health information:
a. HIV Test Results. A written authorization is required for each separate disclosure.
b. DDS Service Records, which includes regional center developmental disability information and records
for services provided to persons with developmental disabilities in a developmental disability center
covered under Division 4.1, Division 4.5, Division 6, or Division 7, of the Welfare and Institutions
Code (“DDS Services”). Records related to developmental disability services provided inside CDCR
do not constitute “regional center developmental disability information.”
c. Part 2 Program Service Records, which include substance use treatment information and records
relating to the identity, diagnosis, prognosis, or treatment of any patient by a federally assisted alcohol
or drug treatment program regulated by the Federal Code of Regulations, Title 42, Part 2, including a
Narcotic Treatment Program (“Part 2 Program Services”). Records related to alcohol and drug
treatment provided by CCHCS do not constitute “substance use treatment information,” because
CCHCS is not a Part 2 program.
2. The release of any specially protected health information is subject to CCHCS policy and applicable law.
(B) Genetic Information for Underwriting Purposes
CCHCS shall not use or disclose genetic information for underwriting purposes. HIM shall consult legal counsel
to discuss any authorization requests specifically related to genetic information.
(C) Psychotherapy Notes
CCHCS providers do not create psychotherapy notes. Further, CCHCS does not make it a practice to request,
nor is it an expectation to accept psychotherapy notes when CCHCS requests mental health records from outside
providers for the continuity of care of patients. HIM shall consult legal counsel to discuss any authorization
requests specifically related to psychotherapy notes.
(D) Mental Health Records
Mental health records are PHI and have the same protection afforded to other PHI. The only mental health
records that have heightened protection is psychotherapy notes.
(4) Components of a Valid Authorization
(A) Format of Authorization
1. The authorization shall:
a. Have typeface of a least 14-point font or be a handwritten document.
b. Be clearly separate from any other language present on the page.
c. Comply with the Federal Trade Commission Act to ensure it does not create a deceptive or misleading
impression.
(B) Identification of Patient
The authorization shall include the patient’s name, CDCR number, and date of birth.
(C) Identity of Disclosing Party
CALIFORNIA DEPARTMENT OF CORRECTIONS AND REHABILITATION
CALIFORNIA CORRECTIONAL HEALTH CARE SERVICES
Health Care Department Operations Manual
Page 3 of 6Chapter 2, Arti
cle 3 2.3.4 Release of Protected Health Information
The authorization shall include the name or other specific identification of the person(s) or organization(s)
authorized to disclose the PHI.
(D) Identity of Recipient
The authorization shall include the name or other identification of the person(s), class of persons, or
organization(s) authorized to receive the PHI.
(E) Specific Description of Information Authorized for Release
The authorization shall include a description specific and meaningful to instruct HIM regarding the PHI to be
disclosed.
(F) Purpose of Use or Disclosure
The authorization shall include a description of each purpose of the requested use or disclosure, including any
limitations on the use or disclosure of the PHI by the persons or entities authorized to receive the PHI.
(G) Expiration
The authorization shall include an expiration.
(H) Statement of Right to Revoke
The authorization shall include a statement that the patient has a right to revoke the authorization. The statement
shall also explain how revocation is accomplished, including that it shall be in writing, and tell the patient about
exceptions applicable to the revocation.
(I) Signature and Date
1. For the patient, the authorization shall be signed and dated by the patient and the signature shall serve no
other purpose than to execute the authorization.
2. For the agent, the authorization shall be signed and dated by the agent and shall include a description of the
agent’s authority to act on behalf of the patient. A copy documenting the agent’s authority shall be attached
(e.g., power of attorney, letters issued in estate proceeding, or declaration of next of kin.)
(J) Authorization as a Condition
The authorization shall state that CCHCS cannot condition treatment of the patient on obtaining a signed
authorization.
(K) Redisclosure
The authorization shall state that if the person or organization that receives the PHI is not subject to the Health
Insurance Portability and Accountability Act of 1996, then the PHI may be subject to disclosure and may no
longer be protected by federal and state privacy regulations.
(L) Copy
The authorization shall state that the person signing it has the right to receive a copy of the authorization.
(5) Defective Authorizations
(A) An authorization is not valid, and shall not be relied upon to disclose PHI if:
1. It is expired.
2. Any required information is missing.
3. It has been revoked.
4. CCHCS becomes aware that information in the authorization is false.
5. The authorization violates restrictions on authorizations, such as combining the release of PHI with
a
patient’s consent for care.
(B) If an authorization is not valid, HIM shall notify the patient of why the authorization is not valid.
(C) If changes are necessary to an authorization, the requester may submit a new authorization form.
(6) Releasing PHI
(A) Verification of Identity and Legal Authority
1. Identity
CCHCS shall verify the identity of any person or entity requesting disclosure if the identity is not already
known.
2. Authority
CCHCS shall verify the authority of any person or entity requesting disclosure that is not the patient and if
the authority is not already known. Acceptable forms of documentation that give authority include:
a. Power of Attorney (shall include a provision that allows medical decision-making or release of health
records)
CALIFORNIA DEPARTMENT OF CORRECTIONS AND REHABILITATION
CALIFORNIA CORRECTIONAL HEALTH CARE SERVICES
Health Care Department Operations Manual
Chapter 2, Article 3 2.3.4 Release of Protected Health Information Page 4 of 6
b. Next of Kin declaration (for deceased patients only)
c. Other form of official documentation (e.g., identification of party as executor of the will, administrator
of the estate or conservator)
3. The verification requirements are satisfied if CCHCS relies on the exercise of professional judgement in
making a use or disclosure or acts on a good faith belief in making a disclosure.
(B) Processing Request and Preparation of Records
1. Log Receipt of Request
Upon receipt of a valid authorization, or a properly executed court order, administrative order, or subpoena,
CCHCS shall log the request into the Access HIM application in the Electronic Health Record System.
2. Identify Information for Release
a. CCHCS shall retrieve the requested documents from the record, corresponding with the requestor if
necessary. If the requested documents are in paper format, they shall be scanned into the health record.
b. CCHCS shall prepare only the minimum necessary amount of PHI to be released pursuant to the
authorization, order, or subpoena; however, if the patient has requested the release of information, the
minimum necessary standard does not apply.
c. HIM shall redact information that has not been authorized for release.
d. HIM shall include a disclosure statement when applicable.
1) The following disclosure statement must accompany a disclosure of HIV test results:
“This information has been disclosed to you from records whose confidentiality is protected by
state law. State law prohibits you from making any further disclosure of it without the specific
written consent of the person to whom it pertains, or as otherwise permitted by law. A general
authorization for release of medical or other information is not sufficient for this purpose.”
2) The following disclosure statement must accompany a disclosure of Substance Use Treatment
Information (services provided outside CDCR):
“(1) This information has been disclosed to you from records protected by federal confidentiality
rules (42 CFR part 2). The federal rules prohibit you from making any further disclosure of
information in this record that identifies a patient as having or having had a substance use disorder
either directly, by reference to publicly available information, or through verification of such
identification by another person unless further disclosure is expressly permitted by the written
consent of the individual whose information is being disclosed or as otherwise permitted by 42
CFR part 2. A general authorization for the release of medical or other information is NOT
sufficient for this purpose (see §2.31). The federal rules restrict any use of the information to
investigate or prosecute with regard to a crime any patient with a substance use disorder, except as
provided at §§ 2.12(c)(5) and 2.65; or (2) 42 CFR part 2 prohibits unauthorized disclosure of these
records.”
3. Exceptions to Granting Access
a. For access purposes, patient representatives shall be treated in the same manner as the patient who is
the subject of the health information unless there is a reasonable belief that:
1) The patient has been or may be subject to domestic violence, abuse, or neglect by the individual.
2) Treating such individual as the patient’s representative could endanger the individual.
3) CCHCS, in the exercise of their expert knowledge and opinion, decides it is not in the best interest
of the patient to treat the individual as the patient’s representative.
b. CCHCS shall not release health information compiled in anticipation of use in a civil, criminal, or
administrative action or proceeding.
c. CCHCS may deny releasing PHI obtained from someone other than a health care provider under a
promise of confidentiality if the release would be reasonably likely to reveal the source of the
information.
d. Review of Mental Health Records Prior to Release
1) If a request is for release of mental health records to an individual (e.g., patient, patient
representative, family member), then HIM shall submit the records to the Chief of Mental Health,
or their designee for review to determine whether there is a substantial risk of significant adverse
CALIFORNIA DEPARTMENT OF CORRECTIONS AND REHABILITATION
CALIFORNIA CORRECTIONAL HEALTH CARE SERVICES
Health Care Department Operations Manual
Chapter 2, Article 3 2.3.4 Release of Protected Health Information Page 5 of 6
or detrimental consequences to the patient or another person if the patient or patient representative
reviews the records.
2) If the Chief of Mental Health, or designee, determines the records may be released, then they shall
notify HIM and HIM shall release the records within 15 business days of the date of the patient’s
initial request.
3) If the Chief of Mental Health, or designee determines the records should not be released in their
current form, then the following shall occur:
a) The Chief of Mental Health or designee shall provide HIM with the following:
i. Documentation which indicates what records shall not be released with a description of the
“specific adverse or detrimental consequences to the patient” the provider anticipates
would occur if review were permitted.
ii. A statement to be shared with the patient that, in plain language, provides an explanation
for refusing the release and information regarding the patient’s option to permit inspection
by an alternative licensed mental health provider or licensed social worker, and information
regarding how to file a complaint or health care grievance.
b) Upon receipt of that information, HIM shall:
i. Scan the provider’s documentation and statement into the health record.
ii. Provide the patient with notification of the refusal to permit inspection of certain records,
reason for the refusal (the statement prepared by the provider), information regarding the
patient’s option to permit inspection by an alternative licensed mental health provider or
licensed social worker, and information regarding how to file a complaint or health care
grievance.
iii. If the patient requests an alternative provider review their records, HIM shall log the
request and provide copies of the records to the licensed mental health professional
designated by the patient.
e. CCHCS may deny, in whole or in part, a patient’s request to obtain PHI, if obtaining PHI would
jeopardize the health, safety, security, custody, or rehabilitation for the patient or other patients, or the
safety of any officer, employee, or other person at CCHCS or responsible for the transporting of the
patient.
f. If CCHCS denies access, a written statement shall be provided by the determinant describing the basis
for the denial and an explanation of the patient’s options for review of the denial, which may include
completing a CDCR 602-HC Health Care Grievance. Further, HIM shall make a written record to be
included with the health records requested, noting the date of the request and the reason for refusing to
permit release of the records.
(C) Arrange Delivery
1. Verbal
CCHCS shall verbally release information to a recipient who has a valid authorization and shall document
such release in the health record pursuant to the HCDOM Section 2.3.15, Patient Health Care Inquiries.
2. W
ritten
CCHCS shall:
a. Compile the requested documents and release the health information in the form and format requested
if it is readily producible in such format (e.g., paper, CD, electronic transfer), along with a Declaration
of Custodian of Records.
b. Release written information requested by a recipient who has a valid authorization pursuant to the
HCDOM Section 2.3.15, Patient Health Care Inquiries.
(D) I
f the records were released pursuant to a court order, administrative order, or subpoena, HIM shall scan the
signed document into the health record.
(7) Accounting of Disclosures
CCHCS shall keep an accurate accounting of each disclosure as set forth in the HCDOM Section 2.2.18, Accounting
of Disclosures. The accounting shall include the name of the patient, a description of the PHI disclosed, a brief
description of the reason for the disclosure (e.g., subpoena, completed CDCR 7385), the date of the disclosure, the
name, title, and address of the individual or organization to whom the disclosure was made.
CALIFORNIA DEPARTMENT OF CORRECTIONS AND REHABILITATION
CALIFORNIA CORRECTIONAL HEALTH CARE SERVICES
Health Care Department Operations Manual
Chapter 2, Article 3 2.3.4 Release of Protected Health Information Page 6 of 6
(8) Processing Timeframes
(A) If a request is valid and the information can be located, CCHCS staff shall provide the records within 15
business days.
(B) If a request is valid but CCHCS does not maintain the record, CCHCS workforce members shall notify the
patient within 15 business days and advise the patient of where to direct their request for access if CCHCS
knows where the PHI is maintained.
(C) If a request is valid but CCHCS cannot produce the records within 15 business days, CCHCS staff shall provide
written notification advising the patient of a delay and the estimated date by which the records will be provided.
CCHCS has an additional 15 business days to produce the records.
(D) If an authorization is not valid CCHCS staff shall notify the patient within 15 business days and provide them
with the opportunity to complete a new authorization.
(9) Fee Schedule
(A) CCHCS shall not charge a currently incarcerated people for the release of health records.
(B) CCHCS may charge a fee (to parties that are not currently incarcerated people pursuant to section (e)(9)(A)
above) to offset the costs associated with responding to requests for health records. The fee shall be consistent
with applicable federal and state law and shall be based on an assessment of factors such as the current cost of
equipment and supplies, labor costs, postage, and administrative overhead.
(10) Authorization Modification or Revocation
(A) To modify or revoke an authorization, the patient shall send a written revocation to CCHCS. If CCHCS receives
a written revocation, all disclosure of PHI shall stop, except as follows:
1. Any actions taken in reliance on the authorization before the receipt of the modification or revocation are
not affected by the modification or revocation.
2. If a partial revocation is received, the disclosure of PHI not affected by the partial revocation shall continue.
(B) Exceptions to a Written Revocation Rule.
CCHCS may request but cannot require a revocation for Substance Use Treatment Information (services
provided outside CDCR) to be in writing. The patient may revoke the authorization verbally or in writing.
(11) Documentation of all Authorizations, Modifications and Revocations
CCHCS shall maintain any authorization, modification, or revocation applied to authorizations for a minimum of
six years from the date of request.
References
• Code of Federal Regulations, Title 42, Part 2, Confidentiality of Substance Use Disorder, Subparts A-E, Sections
2.1-2.67
• Code of Federal Regulations, Title 45, Subtitle A, Chapter A, Subchapter C, Part 160, 164
• California Civil Code, Division 1, Part 2.6, Chapter 2, Sections 56.10
• California Health and Safety Code, Division 10, Part 4, Chapter 7, 120980(g)
• California Health and Safety Code, Division 106, Part 1, Chapter 1, Section 11845.5
• California Health and Safety Code, Division 106, Part 1, Chapter 1, Section 123110
• California Health and Safety Code, Division 106, Part 1, Chapter 1, Section 123115(b)
• California Penal Code, Part 3, Title 7, Chapter 1, Section 5007.6
• California Welfare and Institutions Code, Division 5, Part 1, Chapter 2, Article 7, Section 5328
• California Welfare and Institutions Code, Division 4.5, Chapter 1.6, Section 4514
• Health Care Department Operations Manual, Section, Section 2.2.1 General Use and Disclosure of Protected Health
Information
• Health Care Department Operations Manual, Section 2.2.18 Accounting of Disclosures
Revision History
Effective: 01/2002
Revised: 04/15/2024