If you perform pre-publication or pre-broadcast review of entertainment content you should… 

Know what it is

California’s Confidentiality of Medical Information Act ("the CMIA" or "the Act") is codified in California Civil Code § 56 et seq.,i and is intended to protect the confidentiality of individually identifiable medical information obtained from a patient by a health care provider. The CMIA’s basic prohibition against disclosure is set forth in Civil Code § 56.10(a), which provides that "[n]o provider of health care, health care service plan, or contractor shall disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as provided in subdivision (b) or (c)." ii

Know that it may apply to you

Although the CMIA appears at first glance only to govern the disclosure by health care providers of individually identifiable medical information, that impression is a bit deceiving. Under Section 56.13, the Act also regulates disclosure by recipients of individually identifiable medical information. More specifically, Section 56.13 provides that "[a] recipient of medical information pursuant to an authorization… may not further disclose that medical information except in accordance with a new authorization that meets the requirements of Section 56.11[.]" Importantly, the term "recipient" in Section 56.13 is not defined, so creative plaintiffs’ lawyers could claim that it covers anyone who receives individually identifiable medical information, including media and entertainment companies and their employees.iii


Know how it might be triggered

Assume the following hypothetical:

You are vetting a new reality-television program where a group of professionals all live in a house. One of the participants is a nurse named Sally, who is approached by her house-mate Sam about a strange rash on his arm that he fears is skin cancer. Sally, always eager to offer helpful medical advice, looks at Sam’s rash and immediately recognizes it as eczema, a condition that she’s treated on many patients, including her boyfriend Buddy when he was her patient at General Hospital (where they met when he was admitted for appendicitis). To ease Sam’s worries, Sally tells him that the red scales on his skin are just eczema, and that he should simply grab an over-the-counter remedy from the drugstore. She tells him that he should use Heal-O because that is the brand she used on Buddy when he was admitted to General Hospital with appendicitis a few years back. This entire exchange between Sam and Sally is captured on tape.

As the production lawyer vetting this segment of the program, you should be mindful that Buddy may claim that this is individually identifiable medical information from a health care provider (Sally). Before airing that exchange, you should consider whether the CMIA applies, and if so, whether to edit the exchange or approach Buddy for a Section 56.11 authorization (see below). Even if Sally can produce an authorization from Buddy permitting her to disclose this information, the language of the statute applies to "further" disclosures.

Know the statutorily prescribed consequences for a violation

The CMIA outlines some fairly significant consequences that can result from violations of its nondisclosure provisions, including personal liability to the patient, the imposition of administrative fines and civil penalties, and even criminal liability.iv

Liability to the Patient:

Section 56.35, for example, provides that a patient who has sustained economic loss or personal injury resulting from the disclosure of his/her individually identifiable medical information may recover:

  • Compensatory damages;
  • Punitive damages (not to exceed $3,000);
  • Attorneys’ fees (not to exceed $1,000); and
  • Costs of litigation.

Likewise, Section 56.36(b) gives the patient a remedy even for a negligent disclosure. Under that provision, a patient may bring an action against any person or entity who has negligently released his/her individually identifiable medical information, seeking:

  • Nominal damages of $1,000 (no proof of actual damage is required); and/or
  • Actual damages, if any.

The statute says that these remedies are in addition to any other remedies available at law.

Administrative Fines and Civil Penalties:

A person or entity that negligently or willfully violates the CMIA also may face administrative fines and/ or civil penalties. Section 56.36(c) imposes an administrative remedy or civil penalty of up to $2,500 for a negligent disclosure. That section also imposes an administrative fine or civil penalty of up to $25,000 against any person who knowingly and willfully "obtains, discloses, or uses medical information in violation of [the CMIA]." And where the violator knowingly or willfully obtains or uses the information "for purposes of financial gain," the administrative fine or civil penalty skyrockets to $250,000, plus disgorgement of profits. These steep fines can be assessed per violation!

Criminal Penalties:

The CMIA also imposes criminal penalties. Section 56.36 provides that any violation of the CMIA’s nondisclosure provisions that results in an economic loss or personal injury to a patient is punishable as a misdemeanor.

Know how to avoid potential liability

Under Section 56.13, a recipient of individually identifiable medical information cannot disclose that information without an "authorization that meets the requirements of Section 56.11." If 56.13 applies, and you want to get a written authorization from the individual, Section 56.11 has very specific requirements; for the release to be enforceable under the CMIA, it must meet EACH of the following criteria:


  1. It must be either handwritten by the person who signs it or in a typeface no smaller than 14-point type;
  2. It must be clearly separate from any other language present on the same page and executed by a signature which serves no other purpose than to execute the authorization;
  3. It must be signed and dated by the patient (if an adult), the patient’s legal representative (if the patient is a minor or an adult who lacks decision-making capacity), or the beneficiary or personal representative of a deceased patient;
  4. It must state the specific uses and limitations on the medical information being disclosed;
  5. It must state the name or functions of the person or entity that is being permitted to disclose the medical information;
  6. It must state the names or functions of the persons or entities authorized to receive the medical information;
  7. It must state the specific uses and limitations on the use of the medical information by the persons or entities authorized to receive the medical information;
  8. It must state the specific date after which the person or entity disclosing the information no longer is permitted to do so; and
  9. It must explicitly advise the person signing the authorization of the right to receive a copy of it.

The California Supreme Court has stated that "[t] he authorization requirements… found in section 56.11 are detailed and demanding, reflecting the Legislature’s interest in assuring that medical information may be disclosed only for a narrowly defined purpose, to an identified party, for a limited period of time." The statute also says that "[a]ny waiver by a patient of the provisions of [the CMIA] is contrary to public policy, and is unenforceable and void, except as authorized by Civ. Code § 56.11[.]" vi

Know the First Amendment may provide a defense

The First Amendment provides the media with broad protections against statutes and/or ordinances that purport to proscribe the publication of truthful speech. In other contexts, the United States Supreme Court has held that the government may not constitutionally punish publication of lawfully obtained, truthful information about a matter of public concern. For example, in Florida Star v. B.J.F., vii the Court struck down a Florida statute that imposed damages on a newspaper for publication of a rape victim’s name, which law enforcement authorities improperly had disclosed. Similarly, in Landmark Comm’ns, Inc. v. Virginia,viii the Court held that it would be unconstitutional to criminally prosecute a newspaper for publishing information from confidential judicial disciplinary proceedings. And in Bartnicki v. Vopper, ix the Court concluded that the First Amendment protected the media’s dissemination of excerpts of an illegally intercepted cellular telephone conversation, where the media did not participate in the unlawful interception and the information disclosed involved a matter of public concern. "Privacy concerns[,]" the Court explained, "give way when balanced against the interest in publishing matters of public concern."x The Court has left open the question of whether truthful publication of even entirely private matters constitutionally can be proscribed.xi

The application of the CMIA to the media has not yet been tested, and it might not survive constitutional scrutiny, at least where the information disclosed involves a matter of public interest. Litigating the constitutional issues can be avoided, however, by obtaining a release that satisfies the requirements of Section 56.11.