What is CMIA California (the Confidentiality of Medical Information Act)?

In California, the Confidentiality of Medical Information Act (CMIA), Civil Code §§ 56–56.37, prohibits health care providers, health plans, contractors, and pharmaceutical companies from disclosing individually identifiable medical information without a signed authorization. It binds employers under a separate chapter.

A census of 3,747 hospital websites found third-party tracking on 98.6% of them. A privacy notice can say all the right things while the website underneath transmits visitor data to third parties. Since the Supreme Court’s J.M. v. Illuminate ruling on May 14, 2026, even a significant risk of unauthorized access is treated as a breach of duty.

This guide is for anyone whose product or practice touches Californians’ medical information: app teams, providers, health plans, employers, and the vendors around them.

What is the CMIA?

The Confidentiality of Medical Information Act is California’s medical-confidentiality statute. It was originally enacted in 1979 and repealed and re-enacted in its current form in 1981.

Civil Code § 56.10(a) forbids health care providers, health care service plans, contractors, and pharmaceutical companies from using or disclosing individually identifiable medical information without a signed authorization, subject to enumerated exceptions. 

A separate chapter (§§ 56.20–56.245) imposes parallel duties on every employer that holds employee medical information.

The Act sits in Part 2.6 of Division 1 of the Civil Code, §§ 56–56.37. Its protections attach to “medical information.” § 56.05(j) defines that as individually identifiable information, in electronic or physical form, in the possession of or derived from a provider, plan, pharmaceutical company, or contractor, regarding a patient’s medical history, mental or physical condition, or treatment, now including mental-health and reproductive- or sexual-health application information, immigration status, and place of birth. Information is “individually identifiable” when it contains personal identifying information sufficient to identify the patient, such as a name, address, electronic mail address, telephone number, or Social Security number.

The CMIA is a use-and-disclosure statute. Patient access to medical records lives in Health & Safety Code § 123110, and breach reporting to the state lives in Health & Safety Code § 1280.15. Alongside the disclosure prohibition, § 56.101 imposes a separate duty: create, maintain, store, and destroy medical information “in a manner that preserves the confidentiality of the information.” That is the duty whose meaning the California Supreme Court redefined in 2026.

Who does the CMIA apply to?

The CMIA binds four classes named in § 56.05: health care providers, health care service plans, contractors, and pharmaceutical companies. § 56.06 adds businesses “deemed” providers. And a separate chapter, §§ 56.20–56.245, binds every California employer that holds employee medical information.

HIPAA fluency misleads on the contractor class. HIPAA’s “business associate” reaches any vendor handling PHI under a contract. Section 56.05(d) enumerates four entity types and stops. A billing SaaS or analytics vendor may fall outside the statutory list while still receiving information under the redisclosure limits of § 56.10(e).

Does the CMIA apply to employers?

Yes, through its own chapter, not the provider rules. Under § 56.20, every employer that receives medical information must establish confidentiality procedures. No employer may use or disclose it, or knowingly permit its agents to, without an authorization under § 56.11 or the employment-specific mechanics of § 56.21. Four exceptions (§ 56.20(c)(1)–(4)):

• disclosures compelled by legal process or specific law
• the relevant portion in employer-employee litigation where the employee put the condition at issue
• benefits-administration and leave-eligibility determinations
• disclosure to a provider aiding diagnosis or treatment when the employee cannot authorize

LLoder drew the line in 1997. The Supreme Court confined the Act to how employers handle medical information. It does not decide whether an employer may require a medical exam or drug test. Third-party payroll administrators are not regulated entities under the text. The employer’s duty to police its “employees or agents” is the only hook that reaches them.

Does the CMIA apply to health apps and websites?

Yes. Under § 56.06(b), (d), and (e), a business that maintains medical information through software or hardware is deemed a provider of health care. This includes mental-health apps (effective January 1, 2023) and reproductive- or sexual-health apps (effective January 1, 2024). The deeming trigger is maintaining that information to let individuals manage it or for diagnosis, treatment, or management of a medical condition. Deemed status carries the same duties and liability as a licensed provider.

Three statutory hooks pull digital products in:

• The general software clause. § 56.06(b), predating the recent amendment wave, deems any business offering software or hardware “designed to maintain medical information” for individual management or diagnosis and treatment a provider of health care for CMIA purposes.
• Mental-health digital services. § 56.06(d), added by AB 2089, took effect January 1, 2023. (September 2022 is the chaptering date, not the effective date.)
• Reproductive and sexual-health digital services. § 56.06(e), added by AB 254, effective January 1, 2024.

Deemed status applies “for purposes of this part.” An app vendor becomes a CMIA-regulated entity without being licensed as a clinic, but the duties are real: the § 56.10(a) disclosure prohibition, the § 56.10(d) ban on selling or marketing with medical information, and § 56.36 exposure.

One amendment needs a scope correction. AB 352 (effective January 1, 2024) did not expand coverage. It imposed segregation and access-limitation duties for sensitive-services information under § 56.101(c), a systems obligation, not a scope expansion.

The 2026 boundary

In J.M. v. Illuminate Education (May 14, 2026), the Supreme Court set the boundary at the pleading stage. An education-technology vendor holding student data for educational planning was not shown to be a § 56.06 “provider of health care.” 

The reason: the information was not maintained for individual management or medical diagnosis and treatment. Full analysis in the case section below. It is a pleading-stage boundary, not a sector exemption.

Does the CMIA apply to out-of-state and telehealth healthcare providers?

The provider definition in § 56.05(p) depends on California licensure and facility certification. This leaves clinicians who treat Californians but are licensed elsewhere in an uncertain zone.

App- and software-based businesses face no such gap. Section 56.06‘s deemed-provider clauses depend on what the product does, not where the business is located. Organizations in the licensure gray zone should treat CMIA exposure as a live question rather than assume geography answers it.

The tracking-technology layer that rides on these sites and apps, meaning pixels, tags, and SDKs, is covered in our guide to HIPAA and online tracking technologies. 

How does the CMIA differ from HIPAA?

HIPAA sets the federal baseline, and the stricter rule controls issue by issue. CMIA is stricter than HIPAA on entity reach, authorization formalism, marketing and sale, and remedies. But neither statute is stricter on every axis, so “CMIA is always stricter” overclaims.

One attribution error needs correcting outright. The 15-business-day breach-reporting duty is Health & Safety Code § 1280.15‘s, not the CMIA’s. The CMIA itself contains no general breach-notification mandate.

Health data outside both statutes’ health-care lanes falls to the CCPA/CPRA layer: website analytics audiences, marketing pixels on non-patient pages. 

When does the CMIA prohibit disclosure without authorization?

A valid CMIA authorization must carry all nine § 56.11(b) elements. Missing one causes the authorization to fail. These are format, separateness, signature and date, uses and limitations, disclosure, recipients, recipient-binding language, expiration, and copyright advice. Disclosure without a valid authorization is prohibited unless an enumerated § 56.10 exception applies.

The default rule, § 56.10(a), is absolute in form. No disclosure of individually identifiable medical information without first obtaining a valid authorization.

What makes a CMIA authorization valid?

Section 56.11 prescribes the form and the patient authorization requirements. All nine elements are mandatory.

1. Handwritten or typed in no smaller than 14-point font.
2. Clearly separate from any other language on the page, executed by a signature that serves no other purpose.
3. Signed and dated. Electronic signatures have been permitted since January 1, 2024 (AB 1697).
4. States the specific uses and limitations on the types of information to be disclosed.
5. Names or describes the functions of the entity authorized to disclose.
6. Names or describes the functions of the authorized recipients.
7. States limits on the recipients’ further use.
8. Sets an expiration date or event: one year or less by default, unless the signer requests longer or the authorization relates to a clinical trial or research study (then up to completion of the study).
9. Advises the signer of the right to a copy.

Who may sign is a closed list (§ 56.11(b)(3)).

Two backstops protect the scheme. An authorization missing any element is invalid; the text has no substantial-compliance doctrine. The formality is the point. And § 56.37(b) makes any patient waiver of the Act’s protections unenforceable. That protection does not live in § 56.12, which contains only the copy-on-demand duty. Section 56.37(a) separately bars conditioning care on signing an authorization, and §§ 56.11(c) and 56.12 oblige the entity to hand over copies of what was signed.

When can or must you disclose without authorization?

Section 56.10(b) lists nine situations where providers, plans, and contractors must disclose medical information. Twenty-four more in § 56.10(c) are permitted. Sections 56.10(d) and (f) flatly bar disclosure for sale or marketing and for immigration enforcement.

When is disclosure compelled?

The “shall disclose” list below. Current as of SB 81 (effective September 20, 2025).

When is disclosure permitted without authorization?

The “may disclose” list runs to twenty-four paragraphs. Grouped here by theme, § 56.10(c)(1)–(24).

The hard nevers. Section 56.10(d) bars intentionally sharing, selling, or using medical information for marketing or any purpose “not necessary to provide health care services to the patient.” Section 56.10(f), added by SB 81 in 2025, bars disclosure for immigration enforcement. The redisclosure chain closes the loop. Section 56.10(e) bars contractors and pharmaceutical companies from further disclosure to anyone not engaged in providing direct health care services to the patient. Section 56.13 bars any recipient from further disclosure without a new § 56.11 authorization or other legal permission.

The patient’s access rights are duties for the covered entity. They are in PAHRA, not the CMIA. Inspection within five working days and copies within 15 days of a written request come from H&S § 123110. The statute does not specify “working” or “calendar” days for the copy deadline. Any “15 working days” formula misstates the text. A 250-words-per-item addendum right accompanies any later disclosure of the disputed portion (§ 123111).

What are the CMIA’s penalties and enforcement exposure?

CMIA exposure runs through five tracks. A private action for $1,000 nominal damages per violation without proof of harm, plus actual damages. A separate economic-loss track with a $3,000 punitive cap. Administrative fines tiered at $2,500, $25,000, and $250,000, plus disgorgement for financial-gain violations. Misdemeanor liability applies when a violation causes economic loss or personal injury.

Enforcement occurs in two lanes:

• Administrative fines assessed directly by the Department of Public Health, licensing agencies, certifying boards, or courts
• Civil penalties pursued by the Attorney General, district attorneys, county counsel, and city attorneys or prosecutors; the State Public Health Officer may only recommend those suits.

Can patients sue under the CMIA?

Yes. HIPAA gives patients no private right to sue over an unauthorized disclosure. Under § 56.36(b), an individual whose confidential information was negligently released recovers $1,000 in nominal damages per violation. The text is blunt: “it is not necessary that the plaintiff suffered or was threatened with actual damages.” Actual damages sustained come on top.

What the text does not say matters here. The (b) remedy itself awards no attorney’s fees. Fees live in § 56.35: capped at $1,000, on the separate track for patients who prove economic loss or personal injury, with punitive damages capped at $3,000. They also appear in § 56.36(e) affirmative-defense cases. Bundling “fees” into the nominal-damages remedy misreads the text.

The penalty tiers

Administrative fines and civil penalties under § 56.36(c) scale with culpability. For the same violation, the statute authorizes a fine or a penalty. Never both (§ 56.36(c)(4), (f)(4)).

Whoever assesses the fine or penalty, the Department of Public Health, a licensing agency, a certifying board, or a court weighs eight statutory mitigation factors (§ 56.36(d)): 

1. Good-faith compliance efforts
2. Nature and seriousness
3. Harm caused
4. Number of violations
5. Persistence of violations
6. Duration of violations
7. Willfulness
8. Defendant’s net worth

Penalties assessed under Health & Safety Code § 1280.15 for the same violation offset CMIA fines (§ 56.36(f)(6)). There is no express injunction clause. Equitable relief rests on the statute’s “in addition to any other remedies” phrasing (none in the text as of October 2026).

Criminal exposure is narrower than civil. Under § 56.36(a), a violation is a misdemeanor only where it results in economic loss or personal injury to a patient.

Civil penalties are recovered in the name of the People by the Attorney General, district attorneys, county counsel, and city attorneys or prosecutors (§ 56.36(f)(1)). The State Public Health Officer may only recommend that one of those officials sue (§ 56.36(f)(1)(G)). 

Administrative fines are different: the Department of Public Health, licensing agencies, certifying boards, and courts assess them directly (§ 56.36(d)). CDPH’s separate facility-breach penalty program runs under § 1280.15. Not the CMIA.

For actions filed on or after January 1, 2013, § 56.36(e) gives defendants an affirmative defense. It trades nominal damages for actual damages plus fees. Nine elements build it. They include HIPAA-entity status, breach-notification compliance, preventive security such as encryption, corrective action, and non-retention by the recipient. Case law has not settled how to count violations per patient per event. The 2026 ruling reset the pleading standard for the underlying breach to the significant-risk test. The older “actually viewed” rule survives only to the extent consistent with it.

What the enforcement record actually shows

CMIA’s public record is mostly private lawsuits. As of October, 2026, the review covered published appellate decisions, court-authorized class-settlement notices, and AG/DA announcements, a web-documented slice, not a docket census. Prosecutors appear in blended actions rather than standalone CMIA penalty suits.

The table supports two readings. The 2013–2022 appellate arc was defense-favorable until the Supreme Court displaced its premise in 2026. The dollar weight sits in class settlements, where CMIA rides with CIPA and contract claims rather than standing alone. 

What did the California Supreme Court change in 2026?

In J.M. v. Illuminate Education, Inc. (May 14, 2026) 19 Cal.5th 705, the California Supreme Court did two things at once. It narrowed § 56.06‘s deemed-provider scope. And it lowered the § 56.101 liability bar. A breach of confidentiality is now shown by exposure to a significant risk of unauthorized access or use, even without proof that anyone actually viewed the records. The court partially disapproved Regents, Sutter Health, and Vigil.

The case arose from a breach at an education-technology vendor whose platforms held student survey data, including responses touching on mental health, collected for school districts’ educational planning. The trial court sustained a demurrer. Reversal at the Court of Appeal. Then the Supreme Court reversed and remanded, Justice Liu writing for a unanimous court.

Holding one is scope

J.M. had “not sufficiently alleged that Illuminate is a ‘provider of health care’ within the meaning of Civil Code section 56.06.” The deemed-provider clauses reach businesses maintaining medical information “for purposes of allowing the individual to manage the individual’s information, or for the diagnosis and treatment of the individual.” Screening results used for educational planning, the court reasoned (citing Education Code § 53008(l)), are “a flag for potential risk of reading difficulties, not as a diagnosis of a disability.” The court stressed the statute “was written broadly” but “its scope has limits,” and it decided the case on the allegations.

The second holding lowers the liability bar

Adopting the Attorney General’s framing, the court held that under § 56.101 “a plaintiff does not need to allege that the information was actually viewed by an unauthorized third party; confidentiality is breached when the information is exposed to a significant risk of unauthorized access or use.” The opinion enumerates the relevant circumstances: “the form, duration, and extent of the data breach, as well as any mitigation efforts by the covered entity.” Loss of possession “is a relevant factor, but it is neither necessary nor always sufficient by itself.”

A third holding covers the Customer Records Act

Because the school district, not the student, purchased the vendor’s services, J.M. was not the vendor’s “customer” under the CRA. The “intended beneficiary” theory failed: “the CRA does not authorize suit by all consumers or beneficiaries; it authorizes a civil action for an injured ‘customer.'” For vendors, this holding draws the CRA’s standing boundary as sharply as holding one draws CMIA’s scope boundary.

The disposition of prior law is precise: 

“We disapprove Regents…, Sutter Health…, and Vigil…, to the extent they are inconsistent with this opinion.”

Disapproval, not overruling. The court expressly took no view on the outcomes in Regents and Sutter Health. A smash-and-grab hardware theft with no realistic access can still fail to plead a breach. What changed is that actual viewing is no longer the threshold.

Justice Groban’s concurrence adds two points. 

• A § 56.10(a) “disclosure” requires “an affirmative communicative act,” so a cyberattack suffered by a defendant cannot itself be the disclosure.
• “The ‘significant risk’ standard… demands allegations showing a realistic and appreciable risk,” which “will not exist where the surrounding facts make access or use unlikely, for example, where stolen data is protected by robust encryption.” 

After J.M., mitigation evidence (encryption, access controls, documented response) is pleading-stage liability evidence, not just good practice.

What’s new in 202-2026?

The most recent changes are SB 81, SB 497, and AB 2448. SB 81, effective September 20, 2025, added immigration status and place of birth to protected information and barred disclosures for immigration enforcement. It also tightened the foreign-subpoena and warrant exceptions and added a Health & Safety Code facility-access chapter.

SB 497 followed on October 13, 2025. It is the “legally protected health care activity” shield. Both sit on a 2022–2024 wave that pulled digital health services into scope and added segregation duties.

The Attorney General treated SB 81 as a compliance priority. The October 2025 bulletin restates new obligations for providers, plans, and contractors. Bonta’s office put it plainly. “We expect full compliance with this vital new law.”

Equally useful is what did not change. The remedies architecture (§§ 56.35, 56.36) and the preemption clause are untouched by the 2022-2025 amendments, as of the current text, October 2026.

What are the California CMIA requirements for compliance?

Healthcare organizations subject to both laws must comply with HIPAA and the CMIA, and HIPAA compliance alone does not meet the CMIA’s stricter requirements. Compliance means managing five duty clusters in parallel: authorization discipline; governance of permitted or compelled disclosures and redisclosure; confidentiality-preserving systems; role-specific requirements for employers and health plans; and vendor management.

Organizations should also document identified risks, compliance controls, and corrective actions. A data risk management framework helps structure that process, while a risk register tracks risks, owners, and remediation.

There is no statutory CMIA training mandate. Workforce training is the practical control that makes § 56.101(a)‘s preservation duty real, not a legal requirement in its own right. (The separate-file rule for employee medical information is a FEHA regulation, not the CMIA.) And since May 2026, incident documentation doubles as pleading-stage evidence under J.M.‘s significant-risk analysis. The compliance artifact and the liability evidence are the same file.

A paperwork answer is necessary but not sufficient. The statute’s prohibitions attach to what systems actually do. Verification comes next.

How do you verify what your website or app actually discloses?

You verify by observing what the client side actually transmits. A privacy notice describes intent, not actual transmissions.

The documentation-reality gap is structural. What a page sends is decided by tag managers, SDKs, and third-party scripts at runtime, not by the policy text or CMP configuration. A 12-year study of 1,201 hospital websites found two-thirds used third-party tracking pixels. Hospitals with pixels were 46% more likely to experience a data breach. Researchers said these tools “went under the radar” of the organizations running them.

After J.M., this layer carries both of the statute’s exposure faces. An actual transmission of medical information to an unauthorized recipient is the § 56.10 violation itself. The same flows are the control surface. They create, or defeat, a significant risk of unauthorized access under § 56.101. Our web-tracking guide explains the method. 

MELURNA runs this observation on your own site or app. It identifies linkable values, resolves every recipient, and preserves the evidence chain from collection to destination. It compares what actually happens across accept, reject, no-action, and GPC consent states. 

Request an evidence briefing to see your own data flows →

DISCLAIMER: This guide is for general informational purposes only and does not constitute legal advice. While we strive for accuracy, we make no warranties about the completeness or reliability of this information, and are not liable for any errors, omissions, or actions taken based on its contents. Consult a licensed attorney for guidance specific to your business.