(a) This section shall apply to the disclosure of genetic test results by a health care service plan that are contained in an applicant’s or enrollee’s medical records.

(b) Any person who negligently discloses results of a test for a genetic characteristic to any third party in a manner that identifies or provides identifying characteristics of the person to whom the test results apply, except pursuant to a written authorization as described in subdivision (g), shall be assessed a civil penalty in an amount not to exceed one thousand dollars ($1,000) plus court costs, as determined by the court, which penalty and costs shall be paid to the subject of the test.

(c) Any person who willfully discloses the results of a test for a genetic characteristic to any third party in a manner that identifies or provides identifying characteristics of the person to whom the test results apply, except pursuant to a written authorization as described in subdivision (g), shall be assessed a civil penalty in an amount not less than one thousand dollars ($1,000) and no more than five thousand dollars ($5,000) plus court costs, as determined by the court, which penalty and costs shall be paid to the subject of the test.

(d) Any person who willfully or negligently discloses the results of a test for a genetic characteristic to a third party in a manner that identifies or provides identifying characteristics of the person to whom the test results apply, except pursuant to a written authorization as described in subdivision (g), that results in economic, bodily, or emotional harm to the subject of the test, is guilty of a misdemeanor punishable by a fine not to exceed ten thousand dollars ($10,000).

(e) In addition to the penalties listed in subdivisions (b) and (c), any person who commits any act described in subdivision (b) or (c) shall be liable to the subject for all actual damages, including damages for economic, bodily, or emotional harm which is proximately caused by the act.

(f) Each disclosure made in violation of this section is a separate and actionable offense.

(g) The applicant’s “written authorization,” as used in this section, shall satisfy the following requirements:

(1) Is written in plain language and is in a typeface no smaller than 14-point type.

(2) Is dated and signed, including with an electronic or handwritten signature, by the individual or a person authorized to act on behalf of the individual.

(3) Specifies the types of persons authorized to disclose information about the individual.

(4) Specifies the nature of the information authorized to be disclosed.

(5) States the name or functions of the persons or entities authorized to receive the information.

(6) Specifies the purposes for which the information is collected.

(7) Specifies the length of time the authorization shall remain valid or states an expiration date or event. The expiration date or event shall limit the duration of the authorization to one year or less, unless the person signing the authorization requests a specific date beyond a year or unless the authorization is related to an approved clinical trial, as defined in § 1370.6 of the Health and Safety Code, or medical research study, in which case the authorization may extend beyond one year if the expiration date or event extends no longer than the completion of the relevant clinical trial or research study.

(8) Advises the person signing the authorization of the right to receive a copy of the authorization. Written authorization is required for each separate disclosure of the test results.

(h) If a provider of health care, health care service plan, pharmaceutical company, contractor, or any other entity seeks an authorization from an individual for a use or disclosure of protected health information, the provider of health care, health care service plan, pharmaceutical company, contractor, or other entity shall provide the individual with a copy of the signed authorization and instructions on how to access additional copies or a digital version of the signed authorization.

(i) This section shall not apply to disclosures required by the State Department of Health Care Services necessary to monitor compliance with Chapter 1 (commencing with Section 124975) of Part 5 of Division 106 of the Health and Safety Code, nor to disclosures required by the Department of Managed Health Care necessary to administer and enforce compliance with § 1374.7 of the Health and Safety Code.

(j) For purposes of this section, “genetic characteristic” has the same meaning as that set forth in subdivision (d) of § 1374.7 of the Health and Safety Code.

(Amended by Stats. 2023, Ch. 374, Sec. 3. (AB 1697) Effective January 1, 2024.)