Under CMIA, how does the administrative fine change for a licensed healthcare professional who commits repeated knowing and willful unauthorized disclosures of medical information?
A. The fine escalates with each violation: up to $2,500 for a first violation, up to $10,000 for a second, and up to $25,000 for a third or subsequent violation
B. CMIA does not distinguish between a first violation and repeat violations for licensed professionals
C. The fine decreases with each subsequent violation to account for the professional's prior corrective action
D. The fine is a single flat $50,000 penalty regardless of how many violations occur
Show answer and reasoning
Correct answer: A. The fine escalates with each violation: up to $2,500 for a first violation, up to $10,000 for a second, and up to $25,000 for a third or subsequent violation
- B: CMIA explicitly sets different caps for first, second, and third-or-subsequent violations
- C: The penalty structure escalates upward with repeat violations, not downward
- D: CMIA uses graduated, escalating tiers rather than one flat amount
Source: California Civil Code §56.36(b) — escalating penalty tiers for licensed healthcare professionals with repeat violations ($2,500 first, $10,000 second, $25,000 third and subsequent); https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=56.36
A California healthcare workforce member is trained on both federal HIPAA and California's Confidentiality of Medical Information Act (CMIA). Which statement correctly compares the two laws' scope of protected information?
A. CMIA and HIPAA protect an identical set of information, so compliance with one automatically satisfies the other
B. CMIA only protects information held by hospitals, while HIPAA protects information held by any business
C. CMIA's definition of "medical information" is broader than HIPAA's PHI definition, and CMIA can apply even when no HIPAA-covered entity is involved
D. CMIA does not define "medical information" at all and instead defers entirely to the federal HIPAA definition of PHI
Show answer and reasoning
Correct answer: C. CMIA's definition of "medical information" is broader than HIPAA's PHI definition, and CMIA can apply even when no HIPAA-covered entity is involved
- A: The two laws are not identical in scope or exceptions; overlap exists but each has provisions the other lacks
- B: CMIA's coverage extends well beyond hospitals, including many non-provider businesses under Civil Code §56.06
- D: CMIA defines "medical information" itself in Civil Code §56.05, independent of the federal HIPAA definition
Source: California Civil Code §56.05 — defines "medical information" under CMIA as individually identifiable information, in electronic or physical form, regarding a patient's medical history, mental or physical condition, or treatment; https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=56.05
A California patient's medical information is negligently released by a clinic employee. Under CMIA, what legal remedy is available to the patient that is NOT available to a patient whose PHI is mishandled under HIPAA alone?
A. The patient's only recourse is a complaint to the California Medical Board against the treating physician
B. The patient may bring a private civil lawsuit directly against the entity that negligently released the information
C. The patient may request only that the entity issue a written apology, with no monetary remedy available
D. The patient may file a complaint only with the U.S. Department of Health and Human Services
Show answer and reasoning
Correct answer: B. The patient may bring a private civil lawsuit directly against the entity that negligently released the information
- A: The California Medical Board pathway is separate and does not represent CMIA's private right of action
- C: CMIA authorizes real monetary damages, not merely a non-monetary remedy
- D: That is the HIPAA complaint pathway, not a private right of action, and does not involve a lawsuit by the patient
Source: California Civil Code §56.36(b) — private right of action for negligent release of medical information; https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=56.36
Under federal law, who is authorized to bring an enforcement action for a HIPAA violation?
A. Any individual patient, directly in federal court, without involving any government agency
B. The Secretary of Health and Human Services, and state Attorneys General on behalf of residents
C. Only the patient's employer, if the employer is also a HIPAA covered entity
D. Any licensed physician who becomes aware of the violation, regardless of involvement in the patient's care
Show answer and reasoning
Correct answer: B. The Secretary of Health and Human Services, and state Attorneys General on behalf of residents
- A: HIPAA does not create a private right of action for individuals to sue directly; this is a key contrast with CMIA
- C: HIPAA enforcement authority is not held by employers
- D: HIPAA enforcement authority is not held by uninvolved physicians
Source: 42 U.S.C. §1320d-5 — HIPAA civil penalty enforcement authority rests with the HHS Secretary and state Attorneys General, not private individuals; https://www.law.cornell.edu/uscode/text/42/1320d-5
Under CMIA's private right of action, what must a patient prove to recover the statutory nominal damages amount, even if they cannot show any actual financial harm?
A. That the patient suffered documented financial losses of at least $1,000 as a direct result of the disclosure
B. That the entity had a prior criminal conviction for a similar violation
C. That the disclosure was made with actual malice and specific intent to harm the patient
D. Only that the entity negligently released the patient's confidential medical information; actual harm need not be shown
Show answer and reasoning
Correct answer: D. Only that the entity negligently released the patient's confidential medical information; actual harm need not be shown
- A: CMIA's nominal damages provision exists precisely so a patient need not prove a dollar amount of actual harm
- B: A prior criminal conviction is not a prerequisite to the private right of action
- C: Nominal damages under CMIA do not require proof of malice or intent to harm
Source: California Civil Code §56.36(b) — nominal damages of $1,000 available without proof of actual harm; https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=56.36
