This publication covers your legal rights as to the privacy (“confidentiality”) of your mental health records and information under state law. It discusses situations in which your mental health records and information may be shared (or “released”) with and without your permission.

The privacy of health records and information is a complex area of law subject to both state and federal laws and regulations. This publication provides only basic legal information focused on state law and does not cover all issues on confidentiality. Please contact DRC or an attorney for information about your specific questions or situation.

A. What does keeping records/information confidential mean?

If you receive mental health services (for example, you are involuntarily or voluntarily treated in a state hospital, state developmental center, county psychiatric hospital, private institution, or community mental health program), all information about the services you receive is private and cannot be released without your permission. This means that, in general, no one can share any information about your mental health services or treatment without your permission.1 However, there are some situations when your information may be shared without your permission. Those situations are covered in Section C, below.

B. What mental health information may be released with my permission?

1. Release to designated person: You have the right to choose (or “designate”) a person with whom your information may be shared.2 The professional in charge of your care must approve this designation.3 However, even with your permission, information that your family shared privately with certain professionals, including healthcare providers and attorneys, may not be revealed.
2. Release to your family: You must give permission before a facility is required to disclose to your family your diagnosis, prognosis, medications prescribed, and progress.4 Other rules apply if you are unable to give permission or request that this information not be shared.5
3. Release to other qualified professionals: You (or your conservator) must give permission before professionals treating you in a facility may give your information to another professional who is not employed by the facility and is not responsible for your care.6
4. Release to County Patients’ Rights Advocate: You or your guardian ad litem must give permission before your information is required to be shared with a county patients’ rights advocate assisting you.7 You may cancel your permission at any time.
5. Release to attorney: You must give permission before your information is required to be shared with your attorney. However, even with your permission, information that your family shared privately with certain professionals, including healthcare providers and attorneys, may not be revealed.8
6. Release to potential employers: If you apply for a job, upon your request, your information must be forwarded to a qualified physician or psychiatrist representing the employer. However, the professional responsible for your care may decide that releasing your information is not in your best interest. In that case, you must take additional steps to challenge the professional’s decision.9
7. Release to law enforcement: If you are (or have been) confined under certain penal commitment categories, and the state hospital has your records, your information must be shared with law enforcement investigating a crime, but only if you give permission.10 Note that this information must be shared with law enforcement, even without your permission, if a court orders it.
8. Release to probation officer: If you were treated by a facility, the facility may share your information with a probation officer responsible for evaluating you after a criminal conviction, but only if you give permission.11 This applies only if the facility you were in finds the information relevant to probation’s evaluation. The facility may not share information that your family shared privately. This information can be released only until you are sentenced for the crime. The information released must be kept separate from your probation report. Your information must remain confidential except for the purposes of sentencing. After that, the information must be sealed.
9. Release to insurer: You must give permission before your information may be shared with an insurer when you apply for life or disability insurance.12
10. Release to genetic counselor: You must give permission before your information may be shared with a professional who, upon the request of your blood relative, is providing your blood relative with genetic counseling.13 Different rules apply if you do not respond to a request for permission to release your information.

C. What mental health information may be released without my permission?

1. Release to family: If you are admitted to a facility for mental health services the facility may tell your family that you are at the facility (unless prohibited by federal law) if you are not able to state that this information may not be shared with family.14 Similarly, if your family requests it, and you do not state that this information may not be shared, the facility must notify your family about your release, transfer, serious illness, injury, or death.15
2. Release to designated persons – aftercare plan information: Certain inpatient facilities must provide you and your legal representative (or other person you choose) with aftercare plan information when you are discharged from the facility, even without your permission.16
3. Release of minor/conservatee records to others: Your information must be shared, even without your permission, if you are a minor or conservatee, and your parent, legal guardian, guardian ad litem, or conservator designates in writing persons with whom your information may be shared.17 However, information that your family shared privately with certain professionals, including healthcare providers and attorneys, may not be revealed.
4. Release during conservatorship proceedings: Your information may be shared without your permission in communications between qualified professionals during conservatorship proceedings.18 However, the professionals sharing and receiving the information must work in the same facility or must be responsible for your care.
5. Release to law enforcement – serious danger to foreseeable victim: Your information may be shared without your permission if your therapist believes that you present a serious danger of violence to a likely (“reasonably foreseeable”) victim. Your information may be released to the potential victim(s), law enforcement, and county child welfare agencies as necessary to protect the potential victim(s).19
6. Release to law enforcement – post-5150 or -5250 holds: Limited information must be released, even without your permission, to law enforcement that placed you on a 72-hour hold (5150) or a 14-day treatment hold (5250) once you are released from the hold, but only if law enforcement requests notice.20
7. Release to law enforcement – penal code commitment: In some situations, limited information must be released to law enforcement, even without your permission, if you are in a facility under certain penal code commitment and are being moved, under criminal investigation, or have escaped from a facility.21
8. Release to law enforcement – arrest warrants: The facility must inform law enforcement if you are currently in the facility, even without your permission, when law enforcement provides the facility with an arrest warrant showing that you are wanted for a serious or violent felony.22
9. Release to law enforcement – victim of a crime: Your information may be released without your permission to law enforcement if you are a person with a “mental health disorder” or developmental disability and someone believes that you are a victim of a crime.23
10. Release to law enforcement – crimes against person: Your information must be given to law enforcement, even without your permission, if the facility or health provider believes that you have committed, or have been the victim of, certain crimes while hospitalized. Released information must be limited to the facts of the alleged crime.24
11. Release to law enforcement – protecting elective constitutional officers: Your information must be given to law enforcement, even without your permission, when needed to protect federal or state elective constitutional officers and their families.25
12. Release to the youth authority and adult correctional agency: Your information must be given to the Youth Authority and Adult Correctional Agency, even without your permission, as needed to the administration of justice.26
13. Release related to abuse: Your information may be shared without your permission to prevent, investigate, or address child, elder, and dependent abuse.27 Disorders involving lapses of consciousness may also be released.28 Only relevant information may be released.29
14. Release to domestic violence, child, or elder death review team: Your information may be shared without your permission with a domestic violence death review team30, a child death review team31, or an elder death review team.32
15. Release to the courts: Your information must be shared with the courts as needed to the administration of justice, even without your permission.33
16. Release to entities regarding denial of rights: Information about denial of your rights (but not your identity) must be released, even without your permission, to your conservator or guardian, the local mental health director, the state legislature, the California Office of Patients’ Rights, or county patient’s rights advocates if requested.34
17. Release to Disability Rights California: In certain situations, your information must be released, even without your permission, to Disability Rights California for the protection and advocacy of the rights of individuals with disabilities.35
18. Release to licensing personnel – inspection and licensing of facilities: Your information may be released, even without your permission, to the Department of Public Health or the Department of Social Services to ensure that facilities are following the required rules. The information can be used in certain hearings and judicial proceedings but may only be released to the judge and the parties and must be kept private when the matter is over.36
19. Release to licensing personnel – potential licensing violations: Your information may be shared without your permission with a licensing board for mental health professionals when the Director of State Hospitals believes that a violation happened. The information cannot include your name and must be sealed after the board makes a decision on the violation.37
20. Release to make claim: Your information must be shared, even without your permission, to process a claim for aid, insurance, or medical assistance for your benefit, but only as needed to make that claim.38
21. Release upon disappearance: If you are a voluntary patient (but still meet criteria for an involuntary mental health hold) and leave a facility without notice, your family and law enforcement may be notified of your disappearance, even without your permission. If you are an involuntary patient under a mental health conservatorship and leave a facility without notice, the court and law enforcement must be notified of your disappearance, even without your permission.39
22. Release to the medical examiner or coroner: If you die in a state hospital or other behavioral health facility, your information must be shared with the medical examiner or coroner upon request.40 This information must not be disclosed without a court order or other authorization.41
23. Release to the Legislature: Your information must be shared, even without your permission, with the Senate or Assembly Rules Committees for legislative investigation.42
24. Release for quality assurance: Your information must be shared, even without your permission, with a quality assurance committee established by the California Department of Health Care Services.43
25. Release to the Director of State Hospitals: Your information may be shared without your permission with the Director of State Hospitals for statistical data.44
26. Release to Secretary of Health and Human Services: Your information must be shared, even without your permission, with the Secretary of Health and Human Services when needed to determine compliance with the Health Insurance Portability and Accountability Act (HIPAA).45
27. Release for research: Your information must be shared for research, even without your permission, but only if the Director of Health Care Services, the Director of State Hospitals, the Director of Social Services, or the Director of Developmental Services sets rules for the research and the appropriate board reviews the research first. Researchers must first try to get your informed consent. They must also sign an oath agreeing not to release your information to unauthorized people and must keep your identity private.46

D. What does written consent of authorization mean?

Generally, you (or your parent, guardian, or conservator) must sign a form to allow (“authorize”) the sharing of your information each time information is released.47 Any use of the form must be noted in your medical record. It must include:

• The purpose for using the information;
• The specific information to be released;
• The name of the agency or individual to whom information will be released; and
• The name of the agency or person allowed to release your information.48

The form should also tell you about your right to cancel the authorization.49 You must also receive a copy of the signed consent form.50

E. Are there separate requirements for releasing psychotherapy notes? 

Yes. With some exceptions, psychotherapy notes can only be released if you specifically allow it in a separate form.51

F. If information is released, what does the provider have to do? 

The provider must document the release in your medical record. The documentation must include: 

• The date and situation under which they provided the information;
• The names of the person or agency that received the information, including their relationship to you if any; and
• The information disclosed.52

G. What can I do if someone unlawfully released my confidential health information? 

You may bring a civil action against a person who willfully and knowingly releases your confidential information or records.53 The penalty is $10,000 or three times your actual damages, whichever is greater. You may also bring an action against a person who negligently releases your confidential information or records. The penalty for that is $1,000 plus the amount of your actual damages. Finally, you may bring an action to stop someone from releasing your information or records. You may be entitled to court costs and reasonable attorney’s fees.

You may also file an administrative complaint under HIPAA.54 Entities may be fined for HIPAA violations.55 Also, a person may be punished criminally for knowing violations.56

• 1. See Cal. Welf. & Inst. Code § 5328.
• 2. Cal. Welf. & Inst. Code § 5328(a)(2).
• 3. The statute defines the professional who must approve your designation as a physician and surgeon, licensed psychologist, social worker with a master’s degree in social work, licensed marriage and family therapist, or licensed professional clinical counselor charged with your care. Cal. Welf. & Inst. Code § 5328(a)(2).
• 4. Cal. Welf & Inst. Code § 5328.1(a)-(b).
• 5. Cal. Welf & Inst. Code § 5328.1(a)-(b).
• 6. Cal. Welf. & Inst. Code § 5328(a)(1)(A).
• 7. Cal. Welf. & Inst. Code § 5328(a)(13).
• 8. Cal. Welf. & Inst. Code § 5328(a)(10).
• 9. Cal. Welf. & Inst. Code § 5328.9.
• 10. Cal. Welf. & Inst. Code § 5328.01(a).
• 11. Cal. Welf. & Inst. Code § 5328(a)(11).
• 12. Cal. Welf & Inst. Code § 5328(a)(9).
• 13. Cal. Welf. & Inst. Code § 5328(a)(17).
• 14. Cal. Welf. & Inst. Code § 5328.1(a).
• 15. Cal. Welf. & Inst. Code § 5328.1(b)
• 16. Cal. Health & Safety Code § 1262; Cal. Welf. & Inst. Code §§ 5622, 5768.5.
• 17. Cal. Welf. & Inst. Code § 5328(a)(4)(A).
• 18. Cal. Welf. & Inst. Code § 5328(a)(1)(A).
• 19. Cal. Welf. & Inst. Code § 5328(a)(18).
• 20. Cal. Welf. & Inst. Code §§ 5152.1, 5250.1, 5328(a)(16).
• 21. Cal. Welf. & Inst. Code §§ 5328.2, 5328.3, 5328.01, 7325.5. See also Cal. Penal Code § 4536(b), 1370.5(b).
• 22. Cal. Welf. & Inst. Code § 5328(a)(20)(A).
• 23. Cal. Welf. & Inst. Code § 5004.5(a).
• 24. Cal. Welf. & Inst. Code § 5328.4.
• 25. Cal. Welf. & Inst. Code § 5328(a)(7).
• 26. Cal. Welf. & Inst. Code § 5328.02.
• 27. Cal. Welf. & Inst. Code §§ 5328(a)(12)(A), 5328(a)(21), 5328.5,15633, 18951; Cal. Penal Code §§ 11165-11174; see also 65 Ops. Cal. Atty. Gen. 345 (1982); People v. Stritzinger, 34 Cal. 3d 505 (1983).
• 28. Cal. Health & Safety Code § 103900; 17 Cal. Code of Regs. § 2810.
• 29. Cal. Welf. & Inst. Code §§ 5328.5,15633; Cal. Penal Code §§ 11165-11174; Cal. Health & Safety Code § 103900; 17 Cal. Code of Regs. § 2810.
• 30. Cal. Penal Code § 11163.3(g)(1)(B).
• 31. Cal. Penal Code § 11174.32(e)(2)(B).
• 32. Cal. Penal Code § 11174.8(b)(3)(B).
• 33. Cal. Welf. & Inst. Code § 5328(a)(6).
• 34. Cal. Welf. & Inst. Code § 5326.1.
• 35. Cal. Welf. & Inst. Code §§ 5328.06, 4903. See DRC Publication #5031 (Jan. 1, 2020): Summary of Disability Rights California’s Authority Under State and Federal Law.
• 36. Cal. Welf. & Inst. Code § 5328.15(a).
• 37. Cal. Welf. & Inst. Code § 5328.15(b).
• 38. Cal. Welf. & Inst. Code § 5328(a)(3).
• 39. Cal. Welf. & Inst. Code §§ 5328.3(a)-(b), 7325, 7325.5.
• 40. Cal. Welf. & Inst. Code § 5328.8.
• 41. Cal. Welf. & Inst. Code § 5328.8; Cal. Civil Code § 56.11.
• 42. Cal. Welf. & Inst. Code § 5328(a)(8).
• 43. Cal. Welf. & Inst. Code §§ 5328(a)(14), 14725
• 44. Cal. Welf. & Inst. Code § 5329.
• 45. 45 C.F.R. §164.502(a)(2)(ii).
• 46. Cal. Welf. & Inst. Code § 5328(a)(5).
• 47. Cal. Welf. & Inst. Code § 5328.7.
• 48. Cal. Welf. & Inst. Code § 5328.7; 45 C.F.R. § 164.508(c)(1).
• 49. 45 C.F.R. §§ 164.508(c)(2)(i), 164.508(c)(4).
• 50. Cal. Welf. & Inst. Code § 5328.7; 45 C.F.R. 164.508(c)(4).
• 51. Cal. Welf. & Inst. Code § 5328.04(h); 45 C.F.R. §§ 164.501, 164.508(a)(2). 
• 52. Cal. Welf. & Inst. Code § 5328.6. 
• 53. Cal. Welf. & Inst. Code § 5330. 
• 54. 45 C.F.R. § 160.306. 
• 55. 45 C.F.R. § 160.404(b). 
• 56. 42 U.S.C. § 1320d-6.