California HIPAA release form: meeting HIPAA and Civil Code 56.11

The Confidentiality of Medical Information Act is the California law in Civil Code Part 2.6 that governs how providers and plans share medical information; people shorten it to CMIA. Section 56.11 sets the conditions an authorization must meet for a provider, health care service plan, pharmaceutical company or contractor to release records under it (California Civil Code 56.11).

Most of its list overlaps the federal elements: who discloses, who receives, what information, and an expiration (45 CFR 164.508, Authorizations). The differences are about form and duration, and they are what make an out-of-state template fail in California.

There is no single state-issued form. Each hospital system and agency prints its own, which is why California forms often look oversized: the type size rule is in the statute (California Civil Code 56.11).

The patient signs, or one of the other signers 56.11 lists, such as a legal representative or the personal representative of a deceased patient (California Civil Code 56.11). Requesters such as law firms, disability insurers and employers usually prepare it. At the provider, the record custodian is the office that holds the chart, and it checks the form against both laws before sending copies.

1. Ask the records office whether it insists on its own form, and request a copy if so.
2. Otherwise use the template below; keep the type at 14-point or larger when you print it (California Civil Code 56.11).
3. Fill in the uses and limits line, the recipient and an end date within one year.
4. Sign on the authorization’s own signature line, then keep the copy the provider must give you.

• A form typed in 10-point or 12-point type, which fails the 14-point condition unless it is handwritten (California Civil Code 56.11).
• The release printed inside an intake packet and signed with the same signature as the financial policy.
• An expiration “until revoked”, with no date or event, or a date years away that the patient never asked for.
• A parent signing for a teenager’s records of care the minor could consent to alone (California Civil Code 56.11).

A California authorization is valid when it meets every condition below (California Civil Code 56.11). The right column shows how the federal rule lines up. A compound authorization is one combined with another document on the same form, which the federal rule restricts (45 CFR 164.508, Authorizations).

Section 56.11(b)(3) lists four kinds of signer, and the limits on minors trip people up (California Civil Code 56.11).

• The patient. A minor may sign only for records of care the minor could lawfully consent to under the Family Code (California Civil Code 56.11).
• The patient’s legal representative, if the patient is a minor or lacks capacity, except for those same minor-consent records (California Civil Code 56.11).
• A spouse or the person financially responsible, only to process an application for health coverage where the patient will be an enrolled spouse or dependent (California Civil Code 56.11).
• For a deceased patient, a beneficiary or the personal representative as the Probate Code defines them (California Civil Code 56.11).

The expiration date or event must keep the authorization to one year or less (California Civil Code 56.11). Two exceptions exist: the signer asks for a specific later date, or the release relates to a clinical trial, as the Health and Safety Code defines it, or a medical research study, and ends no later than its completion (California Civil Code 56.11).

For a lawsuit likely to run longer, a firm can either ask the client to choose a specific later date or plan to collect a fresh signature each year. Federal law has no cap, so the shorter California limit is the one to follow (45 CFR 164.508, Authorizations).

Whoever asks the patient to sign must hand over a copy of the signed authorization, with instructions on how to get more copies or a digital version (California Civil Code 56.11). That duty was added by a 2023 amendment, in force since January 1, 2024 (California Civil Code 56.11).

For a law firm, a simple habit covers it: return a scanned copy to the client the day it is signed and note where the original is kept. The federal rule sets a matching copy duty for covered entities (45 CFR 164.508, Authorizations).

An authorization is the detailed form for disclosures the Privacy Rule does not already allow, and a general consent signed at intake cannot stand in for it (HHS, Difference between consent and authorization under the Privacy Rule). Psychotherapy notes still need their own authorization under the federal rule (45 CFR 164.508, Authorizations). For other sensitive records, such as mental health, substance use treatment or HIV test results, give each a separate initial line so the scope is plain, and ask the provider whether it requires its own form for any of them.

Records from a federally assisted substance use disorder program may need a consent that meets 42 CFR 2.31, and SUD counseling notes need a consent of their own (42 CFR 2.31, Consent requirements for substance use disorder records).

The general HIPAA release form guide covers the federal elements that apply in every state.

• California Civil Code 56.11: Sets 14-point or handwritten format, a separate signature, the listed signers, specific uses and limits, a one-year default limit, the right to a copy, and delivery of a signed copy with instructions.
• 45 CFR 164.508, Authorizations: Federal core elements, required statements, plain language, limits on compound authorizations and copy to the individual.
• HHS, Difference between consent and authorization under the Privacy Rule: An authorization is required for uses and disclosures not otherwise allowed, and consent does not replace it.
• 42 CFR 2.31, Consent requirements for substance use disorder records: A Part 2 consent must carry its own listed elements; SUD counseling notes need a separate consent; a consent for use in legal proceedings cannot be combined with any other consent.