Existing law requires the State Department of Public Health to license and regulate health facilities, including general acute care hospitals. Existing law makes a violation of these provisions a crime.

Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), authorizes a covered health care provider to use specified protected health information to maintain a directory of patients in its facility, and to disclose that information to persons who ask for the patient by name. Existing federal law requires a covered health care provider to inform an individual of its privacy practices generally and the use and disclosure of information in the directory and to provide the patient with the opportunity to restrict or prohibit that use or disclosure.

Existing law, the Confidentiality of Medical Information Act, prohibits a health care provider, a contractor, or a health care service plan from disclosing medical information, as defined, but does not prevent a general acute care hospital, upon an inquiry concerning a specific patient, from releasing a patient’s name, address, age, and sex, and a general description of the reason for treatment, among other information, unless there is a specific written request by the patient to the contrary.