CA SB270

Requires clinics, health facilities, home health agencies, and hospices to report unlawful or unauthorized access to patient medical information to the department and affected patients within 5 business days of detection, with exceptions for law enforcement investigations limited to 30-60 days.

Establishes administrative penalties up to $25,000 per patient for initial violations and $17,500 for subsequent violations, with daily penalties of $100 for failure to report (capped at $250,000 per event) and creates a rebuttable presumption that facilities did not notify patients if notification was not documented.

Requires the California Health and Human Services Agency or a state-designated nonprofit entity to facilitate health information exchange electronically among organizations in accordance with applicable state and federal law while protecting patient privacy.

Extends the Health Insurance Portability and Accountability Implementation Act from July 1, 2010, to January 1, 2013, when it will be repealed unless extended by subsequent legislation.

Takes effect immediately as an urgency statute.