Cory J. Fox writes:
On September 18, 2014, California Governor, Jerry Brown, signed Assembly Bill 1755 (“AB1755”) into law, amending breach notification provisions in the California Health and Safety Code applicable to licensed clinics, health facilities, home health agencies, and hospices. Under existing law, certain health care entities licensed by the California Department of Public Health (“CDPH”), including hospitals and clinics, are required to report any unlawful or unauthorized access to or use or disclosure of a patient’s medical information to the affected patient or their representative at their last known address and to the CDPH no later than five (5) business days after the unlawful or unauthorized access, use, or disclosure has been detected. The CDPH then has full discretion to consider all factors “when determining the amount of an administrative penalty” under the statute, including a penalty of $100 per day beyond the reporting deadline up to a maximum of $250,000 per reported event.
Read more on BakerHostetler Data Privacy Monitor.