California layers several laws on top of HIPAA. Providers must follow the Confidentiality of Medical Information Act (CMIA), licensed facilities have their own 15-business-day reporting rule, and the general breach law covers medical and health insurance information.
AT A GLANCE
| Laws | Confidentiality of Medical Information Act (Civil Code § 56 and following); Health and Safety Code § 1280.15; data breach law, Civil Code § 1798.82 |
|---|---|
| CMIA | Applies to health care providers, health plans and contractors. Patients can sue, with nominal damages of $1,000 without proving actual harm. Administrative fines up to $2,500 per negligent disclosure, and much higher for knowing or willful violations |
| Licensed facilities | Clinics, health facilities, home health agencies and hospices must report unauthorized access to the state health department and the patient within 15 business days of detection |
| Facility penalties | Up to $25,000 per patient, up to $17,500 per subsequent occurrence, and $100 per day for late reports, capped at $250,000 per event |
| General breach law | Covers medical and health insurance information. Notice in the most expedient time possible and without unreasonable delay |
| Attorney general | Submit a sample copy of the notice if more than 500 California residents are notified |
02
HOW WE HELP
HIPAA risk assessment
The documented risk analysis HIPAA requires, the foundation for every state law too.
Learn more →Incident response planning
Know who to notify, and by when, before a breach happens.
Learn more →HIPAA compliance program
Policies and procedures that cover both HIPAA and your state requirements.
Learn more →FAQ
Yes. CMIA applies to health care providers, including physician and dental practices, as well as health plans and their contractors.
Licensed clinics, health facilities, home health agencies and hospices must report to the state health department and the affected patient within 15 business days of detecting unauthorized access, use or disclosure.
Yes. Under CMIA, patients can recover nominal damages of $1,000 without proving actual damages, plus actual damages if they can show them.
If more than 500 California residents are notified about a single breach, submit a sample copy of the notice to the attorney general.
Sources: Cal. Health and Safety Code 1280.15 · Cal. Civil Code 56.36 · Lewis Brisbois: California breach summary. This page is general information about the law as of November 2026, not legal advice. Statutes change, so confirm current requirements with your attorney.
Start with the free HIPAA risk assessment, or talk to an analyst about CMIA.
