Custody Medical Records: Access, Authorizations, Audit Trails and the CMIA

Scope and warning#

This Roadmap explains the California and federal routes by which a patient, or those who act for a deceased patient, obtain the medical records of care given in a county jail or other correctional setting in California; the rules governing written authorizations; the separation of health and custody records; electronic-health-record audit trails as evidence; and the CMIA's disclosure and damages provisions. It does not address discovery after suit (Roadmap 084; Roadmap 038 for the employment counterpart), peer-review and quality-assurance protections (Roadmap 085), public records of contracts and oversight (Roadmap 087), preservation demands (Roadmap 007; Model 132), or the regulations specific to state prisons, which were not opened for this page.

The California statutes quoted here were read on a reproduction host (California.Public.Law) because the official Legislative Information site refused this session's requests; they are marked "verified with limitation" and should be re-checked against the official text. The federal regulations were read on the official eCFR. Nothing here is legal advice, and nothing here authorizes any person to obtain any record other than through the processes the law provides. This page uses role vocabulary — patient, detainee, prisoner, personal representative, heir, beneficiary, successor in interest, decedent's estate — because each statute grants its rights to a defined role, and the role must be proved to the custodian.

The factual situation this roadmap addresses#

A generic hypothetical. A 46-year-old man is held pretrial in a county jail. Health services at the jail are provided by a private contractor under a contract with the county, and the contractor's clinicians document care in an electronic health record. Over twelve days he submits written sick-call requests describing worsening abdominal pain. A nurse sees him twice and a mid-level provider once. He is then transported to a community hospital, where he undergoes emergency surgery. He returns to the jail after discharge and is released two months later.

After release, he writes to the jail asking for "my medical file." The sheriff's records unit replies that health records are maintained by the medical contractor. The contractor's records office sends a packet containing progress notes and the hospital's discharge summary, but no medication administration record, no sick-call request forms, and no intake screening. One nursing note in the packet bears an entry time later than the transport. He wants to know what he is entitled to, whether he can get the rest, what the late entry means, whether he can learn who opened or changed his chart, and — because a relative asked — who could have obtained the records if he had died.

A generic variation. Had he died in the hospital, his adult daughter, not appointed by any court, and his sister, who has petitioned for letters of administration, would each want the records — the daughter as an heir, the sister as a prospective personal representative. Neither knows which custodian holds what.

Governing law#

The patient's statutory right: Health and Safety Code § 123100 et seq.

The chapter opens with a legislative finding that "every person having ultimate responsibility for decisions respecting his or her own health care" also possesses "a concomitant right of access to complete information respecting his or her condition and care provided" (Health & Saf. Code § 123100). The operative section follows. Under § 123110(a), "any adult patient of a health care provider, any minor patient authorized by law to consent to medical treatment," and "any patient's personal representative shall be entitled to inspect patient records" on request and payment of reasonable costs, and the provider must permit inspection "during business hours within five working days after receipt of the request." Under § 123110(b), a patient entitled to inspect is entitled to paper or electronic copies, and "The health care provider shall ensure that the copies are transmitted within 15 days" after receiving the request; electronic copies are provided in the form requested if readily producible, or in a readable form the parties agree on. Settled (statutory text; reproduction host).

The section contains five further rules that matter in custody cases. Important alternative: Health and Safety Code § 123130(a) also allows a health care provider to prepare a statutory summary in lieu of making the entire record available for inspection and copying, ordinarily due within ten working days, with a notice-based extension in the specified circumstances not exceeding 30 days from the request. That summary must address listed clinical topics; the provision is not authority to silently send an incomplete chart packet and call it a complete response. A requester receiving a summary should identify what was supplied, ask how the custodian invoked § 123130, and preserve the distinction between a statutory summary and copies requested under HIPAA or another independently applicable law. The summary route and limits require counsel review when statutes overlap.

The section contains these additional rules: A provider may require reasonable verification of identity, but only if it is "not used oppressively or discriminatorily to frustrate or delay compliance with this section" (§ 123110(f)). The section "does not supersede any rights that a patient or personal representative might otherwise have" under other law, including the Evidence Code (§ 123110(f)). A provider may not engage in "withholding patient records or summaries of patient records because of an unpaid bill" (§ 123110(i)). Fees are limited to a reasonable, cost-based amount and, for paper copies, "shall not exceed twenty-five cents ($0.25) per page" (§ 123110(j)(2)). One free copy of relevant records is available when needed to support a claim or appeal for listed public benefits, transmitted within thirty days, unless a private attorney is paying the costs of the claim (§ 123110(d)–(e)). Under § 123110(h), willful violations by the providers listed in § 123105(a)(4)–(10) are unprofessional conduct, and violations by the providers listed in § 123105(a)(1)–(3) are infractions. Settled (statutory text).

Definitions that decide custody cases: § 123105

Three definitions in § 123105 do more work in a jail case than anything else in the chapter.

"Health care provider." The statute lists seventeen categories. The first two are "A health facility licensed pursuant to Chapter 2 (commencing with Section 1250) of Division 2" and "A clinic licensed pursuant to Chapter 1 (commencing with Section 1200) of Division 2"; the list also includes physicians and surgeons, psychologists, physician assistants, nurse practitioners, dentists, licensed clinical social workers and others (§ 123105(a)). The list contains no separate category for registered nurses. Settled (statutory text). A jail infirmary may be licensed as a "correctional treatment center," which the Health and Safety Code defines as "a health facility operated by" the Department of Corrections and Rehabilitation or "a county, city, or city and county law enforcement agency" that "provides inpatient health services to that portion of the inmate population who do not require a general acute care level of basic services"; the definition "shall not apply to those areas of a law enforcement facility that houses inmates or wards who may be receiving outpatient services" and are housed separately for access, security and protection (Health & Saf. Code § 1250(j)). A licensed correctional treatment center is therefore a "health care provider" under § 123105(a)(1). An outpatient jail clinic that holds no facility or clinic license is a different case: the "health care provider" is then the licensed clinician — the physician, physician assistant, nurse practitioner or psychologist — whose patient records are "maintained by, or in the custody or control of" that provider. Analytical inference from the statutory text; whether a particular jail clinic is licensed is a fact to be established from public licensing records.

"Patient records." The term means "records in any form or medium maintained by, or in the custody or control of, a health care provider" relating to the patient's health history, diagnosis or condition, or "relating to treatment provided or proposed to be provided to the patient." It "does not include information given in confidence to a health care provider by a person other than another health care provider or the patient," and it "does not include information contained in aggregate form, such as indices, registers, or logs" (§ 123105(d)). Settled (statutory text). The aggregate-form exclusion is important in a jail: a sick-call log, a pill-pass log or a clinic register listing many patients is not, on the statute's text, a "patient record" that the patient may demand, although the entries concerning the patient that were carried into the chart are. Analytical inference.

"Patient's representative." The definition includes a parent or guardian of a minor, a guardian or conservator of an adult, a health-care agent, and "The beneficiary as defined in Section 24 of the Probate Code or personal representative as defined in Section 58 of the Probate Code, of a deceased patient" (§ 123105(e)). Settled (statutory text).

Mental-health records and the patient's addendum

A provider may "decline to permit inspection or provide copies of the records to the patient" where it determines that access to mental-health records would present a "substantial risk of significant adverse or detrimental consequences." The provider must then make a written record of the request and the reasons, "included with the mental health records requested," and must "inform the patient of the right to require the provider to permit inspection by, or provide copies to," a licensed professional the patient designates in writing (§ 123115(b)). The designated professional may receive the records, but may not let the patient inspect or copy them. Settled (statutory text). The limitation reaches mental-health records, not the medical chart generally.

A patient who reviews the records may submit a written addendum for any item the patient believes incomplete or incorrect, "limited to 250 words per alleged incomplete or incorrect item"; the provider must attach it and "shall include that addendum if the health care provider makes a disclosure" of the disputed portion (§ 123111(a)–(b)). Settled (statutory text). An addendum is a written statement by a prospective party, it becomes part of the record, and opposing counsel will read it. It should be written, if at all, with counsel's advice. Analytical inference.

Enforcement of the access right

"Any patient or representative aggrieved by a violation of Section 123110" "may, in addition to any other remedy provided by law, bring an action against the health care provider to enforce the obligations prescribed by Section 123110," and the judgment may, in the court's discretion, include costs "and reasonable attorney fees to the prevailing party" (Health & Saf. Code § 123120). Settled (statutory text). The fee provision runs to the prevailing party, not only to the patient; an enforcement action against a custodian that properly withheld a category of records carries risk. Analytical inference. The enforcement action is an action for access, not for damages; whether a claim must first be presented to a public entity under the Government Claims Act before an enforcement action against a county custodian is a question the opened text does not answer, because claim presentation governs "claims for money or damages" (Gov. Code § 905, AR-S501). Analytical inference; counsel question.

Evidence Code § 1158: inspection by counsel before suit

Before an action is filed or a defendant appears, an attorney (or the attorney's representative) who presents a written authorization may inspect and copy the patient's records held by a "medical provider," a term § 1158(a) defines by a list that includes physicians and licensed hospitals (§ 1158(a)–(b), paraphrased). The authorization may be signed by the adult patient, a guardian or conservator, a minor's parent or guardian, or "the personal representative or an heir of a deceased patient" (§ 1158(b)). If the records are not made available during business hours within five days after the authorization is presented, the provider may be liable for "all reasonable expenses, including attorney's fees, incurred in any proceeding to enforce this section" (§ 1158(d)). Costs are capped, including "ten cents ($0.10) per page" for standard copies and clerical time "at the maximum rate of sixteen dollars ($16) per hour per person" (§ 1158(e)). Electronic records must be produced in the requested form if readily producible (§ 1158(g)). A medical provider "shall accept a signed and completed authorization form for the disclosure of health information" if it determines that the form is valid and the form is printed in at least 14-point type in substantially the statutory form; the statutory form itself recites that "The medical provider shall not condition treatment, payment, enrollment, or eligibility for benefits on the submission of this authorization" (§ 1158(h)). Settled (statutory text).

Two features make § 1158 the most useful pre-suit tool in a death case. It allows an heir to sign, which means a family can obtain records before a court appoints anyone. And it carries its own enforcement-expense provision. Whether a particular jail custodian is a "medical provider" within § 1158(a)'s list must be checked against that list, entity by entity. Analytical inference; counsel question.

The CMIA: when others may receive the information

Defendant-status caution from controlling 2026 authority: The CMIA's regulated persons and entities are not defined solely by Health and Safety Code § 123105. In J.M. v. Illuminate Education, Inc. (Cal. May 14, 2026), S286699, 19 Cal.5th 705, the California Supreme Court rejected a CMIA complaint for failure to establish that the particular technology company was a covered provider under Civil Code § 56.06. That holding is adverse to an attempt to sue every EHR vendor, affiliated company or custodian merely because it touches medical data. Plead the proper § 56.05/§ 56.06 status and the defendant's actual role; this Roadmap makes no finding about any named contractor or vendor.

The CMIA's basic rule is that "A provider of health care, health care service plan, or contractor shall not disclose medical information" without an authorization, except as the statute requires or permits (Civ. Code § 56.10(a)). A provider "shall disclose medical information if the disclosure is compelled by any of the following," including "A court order issued by a court of this state or a federal court"; a party's subpoena or notice to appear, or "any provision authorizing discovery in a proceeding before a court or administrative agency"; a valid search warrant; a coroner's request "in the course of an investigation"; and a request by "The patient or the patient's representative pursuant to Chapter 1 (commencing with Section 123100)" of the Health and Safety Code (§ 56.10(b)(1), (3), (6)–(8)). Disclosure is permitted to other providers "for purposes of diagnosis or treatment of the patient" (§ 56.10(c)(1)), and the statute provides that mental-health records "may be disclosed by a county correctional facility, county medical facility, state correctional facility, or state hospital," as Penal Code § 5073 requires (§ 56.10(c)(24)). Settled (statutory text; reproduction host).

The CMIA's definitions extend its protection past death: a "Patient" is "a natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains" (§ 56.05(m)). "Medical information" is "any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor" regarding the patient's history, condition or treatment (§ 56.05(j)(1)). Settled (statutory text).

An authorization is valid only if it "Is handwritten or is in a typeface no smaller than 14-point type"; is separate from other language on the page; is signed and dated by the patient, the patient's legal representative, or — for a deceased patient — "The beneficiary, as defined in Section 24 of the Probate Code," or "personal representative, as defined in Section 58 of the Probate Code, of a deceased patient"; "States the specific uses and limitations on the types of medical information to be disclosed"; names the persons authorized to disclose and to receive; "States the specific uses and limitations on the use of the medical information"; states an expiration date or event, ordinarily not more than one year; and advises the signer of the right to a copy (Civ. Code § 56.11). Settled (statutory text). An authorization that a family drafts itself, in small type, with no expiration and no stated use, may simply be refused.

A patient whose medical information "has been used or disclosed in violation of" § 56.10 and specified other sections, and who "has sustained economic loss or personal injury therefrom," may recover "compensatory damages, punitive damages not to exceed three thousand dollars ($3,000)," "attorney's fees not to exceed one thousand dollars ($1,000), and the costs of litigation" (Civ. Code § 56.35). Settled (statutory text). The separate § 56.36(b) remedy was opened for this targeted review. It potentially allows $1,000 nominal damages for a qualifying negligent release of confidential medical information even if actual damages are not established, plus actual damages if any, subject to statutory exceptions including subdivision (e). That is not the same cause-of-action/remedies test as § 56.35; administrative fines or civil penalties under § 56.36(c) should not be presented as an automatic private recovery. In J.M. v. Illuminate Education, Inc. (Cal. 2026), the Supreme Court rejected the older categorical theory that actual viewing by an unauthorized person must always be shown for § 56.101 confidentiality claims: the information must instead be exposed to a significant risk of unauthorized access or use, judged from facts such as the nature, extent, duration and mitigation of the exposure. The court disapproved Regents, Sutter Health and Vigil to the extent inconsistent; it did not hold every loss of possession actionable. It also rejected that plaintiff's asserted status of the particular nonmedical vendor as a CMIA healthcare provider. Statutory coverage, negligent conduct, confidentiality risk and precise remedy must therefore be proved separately; merely alleging a missing medical chart or a late entry does not establish CMIA liability. The CMIA is principally a confidentiality framework; the patient access right here rests on § 123110 and, for HIPAA-covered entities, § 164.524.

The CMIA's integrity rule for electronic records

Electronic health record and electronic medical record systems must "Protect and preserve the integrity of electronic medical information" and "Automatically record and preserve any change or deletion of any electronically stored medical information," and the record of any change must include "the identity of the person who accessed and changed the medical information," "the date and time the medical information was accessed," and "the change that was made to the medical information" (Civ. Code § 56.101(b)(1)(A)–(B)). The 2026-accessible reproduction of § 56.101 additionally contains sensitive-services access-control and confidentiality provisions, including subdivision (c); earlier historical reproductions omit amendments. Section 56.101(b)(2) separately states that a patient's ability to access or obtain EHR copies remains governed by otherwise applicable state and federal patient-access law; an audit-log retention duty in § 56.101(b)(1) is not by itself an unconditional patient right to a raw audit log. Which parts of § 56.101 govern a particular vendor, clinic or care event must be checked against the effective-date text and the record system. 2025 statutory reproduction opened; original source-A subsection/dates may be stale; official California legislative authentication remains OPEN.

HIPAA: right of access, personal representatives and preemption

The federal privacy rule applies to a "covered entity," which includes "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter" (45 C.F.R. § 160.103). Whether a particular jail contractor or county health program is a covered entity depends on its electronic billing transactions and must not be assumed (Roadmap 128.1). Settled (definition); application fact-dependent.

An individual has "a right of access to inspect and obtain a copy of protected health information" in a designated record set, except "Psychotherapy notes" and "Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding" (45 C.F.R. § 164.524(a)(1)(i)–(ii)). The designated record set includes "The medical records and billing records about individuals maintained by or for a covered health care provider" and other records "Used, in whole or in part, by or for the covered entity to make decisions about individuals" (45 C.F.R. § 164.501). The covered entity must act on a request within thirty days of receipt and may extend once, by no more than thirty days, with a written statement of reasons (§ 164.524(b)(2)). Neither "not printed in the chart" nor "stored by an EHR business associate" alone proves a patient-specific record is outside a designated record set; conversely, a technical audit event is not automatically a patient record or used for decisions about that patient. Ask the custodian how each requested category is classified and preserved, without representing that the statute compels delivery of all backend logs. Settled (regulatory text; official host).

A covered entity must "treat a personal representative as the individual" (45 C.F.R. § 164.502(g)(1)). For a deceased individual, the rule applies where, under applicable law, "an executor, administrator, or other person has authority to act on behalf of a deceased individual" or of the estate: that person is treated as the personal representative for information relevant to the representation (§ 164.502(g)(4)). Protection continues "for a period of 50 years following the death of the individual" (§ 164.502(f)), and protected health information excludes information "Regarding a person who has been deceased for more than 50 years" (§ 160.103). Settled (regulatory text). The federal definition is narrower than California's: § 164.502(g)(4) looks to authority to act for the estate, while § 123105(e) and Civ. Code § 56.11 also recognize a "beneficiary," and Evid. Code § 1158 recognizes an "heir." Analytical inference.

Where federal and state access rules diverge, the federal rule preempts a "contrary" state provision (45 C.F.R. § 160.203), but not a state provision that "relates to the privacy of individually identifiable health information" and is "more stringent" (§ 160.203(b)); and a state law is more stringent if, "With respect to the rights of an individual, who is the subject of the individually identifiable health information, regarding access to or amendment of individually identifiable health information," it "permits greater rights of access or amendment, as applicable" (§ 160.202). Settled (regulatory text).

Separate HIPAA request: accounting of certain disclosures, not the EHR audit log

Under 45 C.F.R. § 164.528(a)–(c), an individual may request an accounting of specified disclosures by a HIPAA covered entity during the preceding six years (or a shorter specified period). The rule excludes multiple classes, prominently treatment/payment/healthcare-operations disclosures and disclosures to correctional institutions or lawful-custody officials under § 164.512(k)(5), and permits certain law-enforcement/oversight suspensions. An accounting ordinarily must be provided within 60 days, with one conditional written extension of up to 30 days; the first accounting in a 12-month period is free. An accounting is not a list of every internal chart view, modification or employee login, and should never be described as the same thing as the raw electronic audit trail. The exclusions may sharply limit its value in a jail case, but it is a separately identifiable pre-suit pathway worth evaluating. Federal regulatory text; targeted verification only.

HIPAA's correctional-institution provisions

The federal rule defines a "Correctional institution" as "any penal or correctional facility, jail, reformatory, detention center, work farm, halfway house," or residential community program center "operated by, or under contract to, the United States, a State," or a political subdivision, and an "Inmate" as "a person incarcerated in or otherwise confined to a correctional institution" (45 C.F.R. § 164.501). It then provides, as an unreviewable ground for denying access:

Five precision points follow from the text. The ground reaches a request "to obtain a copy"; it does not, in terms, reach inspection. It is permissive ("may deny"). It belongs to a correctional institution or a provider "acting under the direction of" one. It requires a jeopardy determination of the kinds listed. And it concerns an "inmate's" request. Settled (regulatory text). A separate provision states that an individual is "no longer an inmate when released on parole, probation, supervised release, or otherwise is no longer in lawful custody" (§ 164.512(k)(5)(iii)); read with the definition of "Inmate," the copy-denial ground is not a basis for refusing copies to a person who has been released. Analytical inference from the definitions. Whether California's § 123110, which contains no correctional exception in the opened text, independently requires copies to a person still in custody — so that the federal permissive denial yields to the "more stringent" state access right — depends first on whether the custodian is a "health care provider" under § 123105(a), and no California appellate authority on the point was located for this page. Unsettled; counsel question.

The rule also permits a covered entity to disclose protected health information "to a correctional institution or a law enforcement official having lawful custody of an inmate" when the institution or official represents that it is necessary for listed purposes, including "The provision of health care to such individuals;" "The health and safety of such individual or other inmates;" the health and safety of officers, employees and transport personnel; "Law enforcement on the premises of the correctional institution;" and "The administration and maintenance of the safety, security, and good order of the correctional institution" (45 C.F.R. § 164.512(k)(5)(i)(A)–(F)). A covered entity that is a correctional institution "may use protected health information of individuals who are inmates for any purpose for which such protected health information may be disclosed" (§ 164.512(k)(5)(ii)). Settled (regulatory text). That is why health information lawfully appears on the custody side, and why the custody record must be requested as well as the chart.

Audit controls under the federal security rule

The federal security rule requires covered entities to "Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information," and to "protect electronic protected health information from improper alteration or destruction" (45 C.F.R. § 164.312(b), (c)(1)). Settled (regulatory text). California adds, for licensed health facilities and clinics that keep records electronically only, a requirement of "a mechanism to ensure that once a record is input, it is unalterable" and "an offsite backup storage system" (Health & Saf. Code § 123149(a)–(b)). Section 123149 applies to providers licensed under listed Health and Safety Code sections that "utilize electronic recordkeeping systems only," and so may not reach an unlicensed jail clinic. Settled (text); application fact-dependent.

Title 15: health records and custody records are different records

California's minimum standards for local detention facilities require the health authority to maintain "individual, complete and dated health records," including intake screening, complaints of illness or injury, the "names of personnel who treat, prescribe, and/or administer/deliver prescription medication," and medication records (Cal. Code Regs., tit. 15, § 1205(a)). "Access to the health record shall be controlled by the health authority or designee," and "such files shall be maintained separately from and in no way be part of the person's other jail records"; the responsible physician or designee "shall communicate information obtained in the course of health screening and care to jail authorities" where necessary for the person's welfare, jail management or security (§ 1205(b)). "Written authorization by the incarcerated person is necessary for transfer of health care record information" unless other law provides otherwise (§ 1205(c)). Incarcerated persons may not be used to maintain health records (§ 1205(d)). Settled (regulatory text; reproduction host).

The facility administrator, for its part, "shall develop written policies and procedures for the maintenance of individual records for each incarcerated person," including "medical orders issued by the responsible physician and staff response," "non-medical information regarding disabilities and other limitations," and "reports of disciplinary actions taken" (tit. 15, § 1041(a)). Settled (regulatory text). Two custodians therefore hold two record sets that overlap at predictable points: a physician's order for observation, a housing restriction, a transport, a refusal, a disciplinary report arising from a medical event. A request addressed only to the health custodian will miss the custody side, and a request addressed only to the sheriff will miss the chart. Analytical inference.

Mental-health records in custody: two further regimes

Records of services provided under specified divisions of the Welfare and Institutions Code — "All information and records obtained in the course of providing services under Division 4" and the other listed divisions "to either voluntary or involuntary recipients of services are confidential" — may be released to the patient's attorney "upon presentation of a release of information signed by the patient," "To the courts, as necessary to the administration of justice," and "To parties to a judicial or administrative proceeding as permitted by law," subject to the federal requirements the statute cross-references (Welf. & Inst. Code § 5328(a), (a)(6), (a)(10), (a)(27)). Whether a jail's mental-health records fall within § 5328 depends on whether the services were provided under one of the named divisions — for example by a county behavioral-health program — and is a counsel question. Settled (text); application unsettled.

Penal Code § 5073 requires mental-health records to move with a person whose custody transfers between a county correctional facility, a county medical facility, a state correctional facility and a state hospital, "by electronic transmission when possible," at the time of transfer or "within seven days of the transfer of custody," for the purpose of statutory evaluations and "the continuity of mental health treatment of an inmate being transferred between those facilities." The defined records include assessments, progress notes, incident reports, medication lists and "Suicide watch, mental health crisis, or alternative housing placement records" (Penal Code § 5073). Settled (statutory text). A person who went from jail to prison may therefore have jail mental-health records in the receiving institution's file.

Substance-use-disorder records: 42 C.F.R. Part 2 (2026 compliance)

When a record originates from a federally assisted substance-use-disorder diagnosis, treatment or referral Part 2 program, additional confidentiality and redisclosure restrictions may apply to identifiable SUD records. Part 2 is not automatically triggered by every notation of substance use in a jail chart; program coverage and the record's origin must be documented. Under 42 C.F.R. § 2.23(a), Part 2 itself does not prevent a program from giving the patient access to the patient's records and does not require Part 2 patient consent just to provide that access; this is distinct from other applicable access laws. The February 2024 final rule's general compliance deadline was February 16, 2026, and HHS OCR began its Part 2 civil complaint program on that date. The rules particularly restrict using covered records in proceedings against the patient absent applicable consent or appropriate court process. Counsel should separate Part 2 consent, HIPAA authorizations and California CMIA authority rather than combine them into one universal form. HHS OCR primary guidance updated September 29, 2026; 42 C.F.R. § 2.23 2026 reproduction; applicability unproved.

Custody, personnel and public records (description level)

The California Public Records Act "does not require disclosure of" "personnel, medical, or similar files, the disclosure of which would constitute an unwarranted invasion of personal privacy" (Gov. Code § 7927.700). The Act is the wrong tool for a patient's chart and the right tool for contracts, policies, aggregate data and certain custody records (Roadmap 087). Peace-officer and custodial-officer personnel records are "confidential and shall not be disclosed in any criminal or civil proceeding except by discovery pursuant to Section 1043 and 1046 of the Evidence Code," subject to the categories that subdivision (b) makes available under the Public Records Act, including uses of force resulting in death or great bodily injury and specified sustained findings (Penal Code § 832.7(a)–(b)). Those routes are discussed in Roadmaps 084 and 087. Since July 1, 2024, records relating to investigations of a death in a local detention facility "shall not be confidential and shall be made available for public inspection" under the Public Records Act, notwithstanding § 832.7(a) or any other law; the record "shall include all investigative reports," together with video and audio evidence, interview transcripts, autopsy reports and findings, subject to redaction for listed purposes (including confidential medical information whose disclosure federal law specifically prohibits) and to delays during active investigations (Penal Code § 832.10, AR-064-S08; Roadmap 085). For a family after a death, that request is often the fastest lawful route to the custody-side record. Custody-death reporting to the Attorney General is addressed in Roadmaps 064 and 093 (Gov. Code § 12525, AR-093-S02). Settled (statutory text) as to the quoted provisions; application at description level.

Who may ask, and on what authority#

The routes divide by role, and the role must be documented to the custodian.

The living patient. An adult patient, current or former, requests personally under § 123110 and, where the custodian is a HIPAA covered entity, under § 164.524. A detainee or prisoner who is still in custody may meet the correctional copy ground described above; a released person should not. A request should name the patient's full name, date of birth and booking or patient number, the facility, the dates of custody, and the record categories sought, and should ask for electronic copies where available. Analytical inference from §§ 123110(b), 164.524(a)(2)(ii).

The personal representative. An executor or administrator appointed by a probate court is a "personal representative" under both California law (§ 123105(e), citing Probate Code § 58) and the federal rule (§ 164.502(g)(4)). Letters of administration are the document that proves the role. Settled.

The beneficiary and the heir. California's access statute and the CMIA also recognize a "beneficiary" as defined in Probate Code § 24 (§ 123105(e); Civ. Code § 56.11), and Evid. Code § 1158 recognizes an "heir" as a signer of an attorney's authorization. A family member who is neither appointed nor clearly a beneficiary may find that a HIPAA-governed custodian, applying § 164.502(g)(4)'s narrower test, asks for court documents. Analytical inference.

The successor in interest. A person who commences or continues a decedent's action as successor in interest must execute and file a declaration stating, among other things, that "No proceeding is now pending in California for administration of the decedent's estate," that "The affiant or declarant is the decedent's successor in interest," and that "No other person has a superior right to commence the action or proceeding," with a certified copy of the death certificate attached (Code Civ. Proc. § 377.32). The declaration governs the lawsuit; it is not itself a records statute, but custodians commonly accept it as evidence of authority. Settled (text) as to § 377.32; Analytical inference as to custodians' practice. The survival and wrongful-death roles are distinct (Code Civ. Proc. §§ 377.30, 377.60; AR-0961-S06, AR-065-S08; Roadmap 065).

Counsel. An attorney acts on the client's authorization, under § 1158 before suit and by subpoena or discovery after it (Roadmap 084).

Record families, custodians and routes#

Applying the law to the hypothetical#

The released man is an adult patient and is no longer an "inmate" within the federal definitions; the correctional copy ground should not be a basis for refusing him copies. Analytical inference. His request should be addressed to the health custodian, invoking § 123110 and, in the alternative, § 164.524, and should list the missing categories by name — intake screening, all sick-call request forms and the responses, the medication administration record, nursing protocols or encounter forms, provider orders, vital-sign flowsheets, laboratory results, transport and return documentation — asking for the records in electronic form if they are kept electronically. A parallel request to the sheriff should seek the custody-side records of medical orders and staff responses, the transport records and the housing history, recognizing that much of that will be obtainable only in discovery or under the Public Records Act at description level. A request to the hospital will produce the outside records, which are often the most reliable causation anchor (Roadmap 075).

If the health custodian does not respond within the statutory periods, or responds incompletely, the next step is a written follow-up identifying the categories still missing; then counsel's § 1158 inspection; then, if necessary, an enforcement action under § 123120 or, for a HIPAA covered entity, a complaint to the Office for Civil Rights (45 C.F.R. § 160.306, AR-096-F05; Roadmap 128.1). Ask whether the provider is invoking § 123130 to supply a statutory summary rather than full copies, and preserve that distinction; another applicable law may independently require additional designated-record-set material. An incomplete packet is not by itself evidence that anything was withheld: sick-call forms may be scanned into a separate folder, medication records may live in a pharmacy module, and an aggregate log is not a "patient record" at all. Analytical inference.

The late-dated nursing note proves nothing by itself. A clinician may properly make a late entry identified as such. What matters is whether the entry is labeled as late, what it says, what (if anything) it replaced, and when it was first created — information that lives in the audit trail and version history, not in the printed chart. The man should not assume the raw audit trail is obtainable simply by filing a patient record request; access to it is usually litigated in discovery, although any patient-specific designated-record-set material must be assessed rather than categorically excluded. A separate § 164.528 accounting request may provide limited information about qualifying disclosures but not a complete internal access history. He must never attempt any unauthorized system access. What he can do now is cause a preservation demand to be sent that names the audit trail, the version history and the access logs for his record for the period (Roadmap 007; Model 132), so that the data exist when discovery reaches them (Roadmap 084). If a pleading will eventually describe the late entry, the rule is fixed: Do not allege a fact unless you have a good-faith factual basis for it. A late timestamp is a basis for a question, not for an allegation of alteration.

In the variation, the sister who has petitioned for letters becomes a personal representative under both California and federal law when letters issue, and can then request directly. Before that, the daughter, as an heir, can sign a § 1158 authorization for an attorney's pre-suit inspection, and may qualify as a "beneficiary" under § 123105(e) and § 56.11 depending on the Probate Code analysis. Which role each family member occupies is a probate question for counsel, and it should be answered before anyone signs anything. Analytical inference.

A step-by-step approach#

1. Identify the roles: is the requester the patient, an appointed personal representative, a beneficiary, an heir, or a prospective successor in interest? Gather the documents that prove the role (identification; letters; death certificate; a § 377.32 declaration if a lawsuit is contemplated).
2. Identify the custodians: the health authority for the period (which may have changed if the contractor changed), the sheriff, each outside hospital and ambulance provider, any receiving prison or state hospital, and the coroner (Worksheet 101 for entity identity).
3. Send the health custodian a written request under Health & Saf. Code § 123110 and 45 C.F.R. § 164.524, listing the record categories by name and asking for electronic copies; keep a dated copy and proof of delivery (Model 132).
4. Send the custody custodian a separate request for custody records, and consider a Public Records Act request for non-exempt records (Roadmap 087).
5. At the same time, send preservation demands naming the audit trail, version history, access logs, video, and the sick-call and pill-pass logs (Roadmap 007; Model 132; Worksheet 114). For a HIPAA covered custodian, assess a separate § 164.528 disclosure-accounting request; do not label this request as a complete internal chart access log. If SUD-program-origin records are implicated, identify Part 2 coverage before sending or redisclosing them.
6. Calendar the statutory response periods as facts about the request, not as claim deadlines; and calendar the claim sources separately with counsel (Roadmaps 008, 078, 082).
7. On an incomplete response, send a written deficiency letter naming the missing categories; then counsel's Evid. Code § 1158 inspection with a statutory-form authorization; then enforcement under § 123120 or an OCR complaint where appropriate.
8. Log every record received in Worksheet 109 with its source, date received and record key, and never mix documents from unlawful sources into the file.

Elements of the claim#

Action to enforce access (Health & Saf. Code § 123120). On the statutory text: (1) the plaintiff is a patient or patient's representative; (2) the defendant is a "health care provider" within § 123105(a); (3) the records sought are "patient records" within § 123105(d); (4) a request was made and reasonable costs tendered as § 123110 requires; (5) the provider failed to permit inspection or provide copies as § 123110 requires, without a statutory justification such as § 123115(b); and (6) the plaintiff is aggrieved. Analytical inference from the statutory text; no case authority was opened for this page.

CMIA damages (Civ. Code § 56.35). On the statutory text: (1) the plaintiff is a "patient" (living or not, § 56.05(m)); (2) the information is "medical information"; (3) it was used or disclosed in violation of § 56.10 or another listed section; (4) the plaintiff sustained economic loss or personal injury "therefrom"; and (5) damages. Analytical inference from the statutory text. Who may sue on a deceased patient's CMIA claim is a survival question (Code Civ. Proc. § 377.30, AR-0961-S06; Roadmap 065).

Underlying injury and death claims are elsewhere: Roadmaps 042–050, 065, 066, 078.

Potentially relevant defendants#

On this page, the relevant parties are custodians, identified by function, not defendants identified by liability: the health authority that maintained the chart for each period (a contractor, a county health or behavioral-health department, or a licensed correctional treatment center); the individual licensed clinicians whose records the chart contains, where no facility or clinic license exists; the sheriff as custodian of custody records; outside hospitals, ambulance providers and laboratories; the electronic-health-record vendor as a holder of audit data on the custodian's behalf; receiving institutions; and the coroner. Each must be identified from documents (Roadmap 003; Worksheet 101). Before any action is filed against an entity in the Wellpath corporate family, check Roadmaps 090/091.

Administrative prerequisites#

None for a request under § 123110, § 164.524 or § 1158. A HIPAA access complaint goes to the Office for Civil Rights under 45 C.F.R. § 160.306 (AR-096-F05; Roadmap 128.1). A claim for money or damages against a local public entity must be presented under the Government Claims Act before suit (Gov. Code §§ 905, 945.4; AR-S501, AR-096-S02; Roadmap 078); whether that requirement applies to an access-enforcement action seeking no damages is a counsel question. A professional-negligence action against a health care provider requires the notice of intent under Code Civ. Proc. § 364 (AR-096-S04; Roadmap 066); a records request is not that notice.

Limitation periods#

Records statutes set response periods, which are not limitation periods. They are stated in the first column for orientation only; nothing here computes a date.

Evidence and records to obtain#

Key: H presently has lawfully; R statutory request; D discovery or subpoena only; P potentially privileged or private; K someone else must preserve but need not produce voluntarily (Roadmap 007); X must not access, copy or remove.

• Discharge papers, prescriptions and appointment slips the patient was given on release or return from the hospital — H.
• Letters or notices the patient or family received from the jail, the contractor or the hospital — H.
• Health record for each custody period: intake screening, sick-call requests and responses, progress notes, provider orders, medication administration records, vital-sign flowsheets, laboratory and imaging results, refusal forms, transport and return documentation — R (§ 123110; § 164.524; § 1158).
• Outside emergency-department, hospital, ambulance and laboratory records — R.
• Mental-health records — R, subject to § 123115(b) and, where applicable, Welf. & Inst. Code § 5328.
• Records transferred to a receiving prison or state hospital — R from the receiving institution.
• Coroner's report and autopsy, where a death occurred — R under the coroner's own procedures (not opened; Roadmap 064).
• Custody records: booking, classification, housing history, safety-check logs, incident and transport records, the custody-side record of "medical orders issued by the responsible physician and staff response" — D, with Public Records Act requests for non-exempt categories at description level (Roadmap 087).
• Records of the investigation of a death in a local detention facility, including investigative reports, video, audio and autopsy reports — R under Penal Code § 832.10 (a Public Records Act request), subject to redaction and delay (Roadmap 085).
• Video — K now (preservation demand), D later.
• Aggregate sick-call, pill-pass and clinic logs — K now, D later.
• Audit trail, version history and access logs for the patient's record — K now, D later.
• The county's health-services contract and amendments — public records (Roadmaps 086, 087).
• Mortality review, quality-improvement and peer-review documents — P (Evid. Code § 1157, AR-032-S04; Roadmap 085).
• Personnel records of custodial officers — P; reachable only by the Pitchess procedure or the § 832.7(b) categories (Roadmap 084).
• Other patients' records, including cellmates' — P and, for the requester, X.
• Any jail, contractor, hospital or vendor information system, including through retained credentials or a cooperative employee — X.

Favorable and adverse facts#

Facts that help: a written, dated request that names record categories and the statute; proof of delivery; a role document (letters, a beneficiary analysis, a § 1158 authorization in statutory form); preservation demands sent early, naming audit data; a clean file of records obtained only through lawful channels; outside hospital records that fix the clinical picture at transfer.

Facts that hurt: an oral request; an authorization in the wrong form or signed by a person without the claimed role; requests addressed to the wrong custodian; a file containing documents of uncertain provenance or other patients' information, which can taint a case and expose the holder; a patient addendum written in anger and now part of the record; and delay, which allows routine retention schedules to overwrite video and logs.

Likely defenses#

A custodian resisting a request, or a defendant later contesting the records, can be expected to argue that it is not a "health care provider" under § 123105(a) or not a covered entity under § 160.103; that the item sought is an aggregate log or confidential third-party information excluded from "patient records"; that the requester has not proved the claimed role; that the correctional copy ground applied while the patient was in custody; that § 123115(b) justified withholding mental-health records; that the material was "compiled in reasonable anticipation of" litigation; that quality and mortality-review documents are protected by § 1157 (Roadmap 085); and that any later-dated entry was a properly labeled late entry. Each is met by the text above and by the document that establishes the custodian's status or the requester's role. For a CMIA confidentiality claim, the opposing party may additionally rely on J.M. v. Illuminate Education, Inc. (Cal. 2026) to contest covered-entity status, causation and whether facts show a significant confidentiality-exposure risk rather than mere record loss. That decision also forecloses a categorical "no proof of actual viewing, no § 56.101 claim" defense. Test the defendant's specific record-handling role, the precise information exposed, access controls/encryption, scope and duration of exposure, mitigation evidence and whether the pleaded statutory subsection actually governs that conduct; do not extrapolate an actionable breach from record absence or timestamp irregularity alone. The defense playbook collects the merits defenses (Roadmap 133).

The deep companion to Roadmap 133 for these defenses is Playbook 143 (evidentiary, privilege and procedural defenses).

Causation#

Records do not cause injury, and this page is not a causation page. Records bear on causation in two ways. They are the proof of it — the timeline of symptoms, orders, delays and outside findings on which experts build (Roadmap 075). And their absence can shape the inferences a court allows: if records that should have been preserved after the duty attached are lost, the remedies Roadmap 007 describes may follow, including, in federal court, the measures of Rule 37(e) (Roadmap 084). For a CMIA damages claim, causation is an element on the statute's text: the loss or injury must have been sustained "therefrom."

Damages and remedies#

Access remedies are modest and specific: an order compelling access and a discretionary award of costs and fees to the prevailing party (Health & Saf. Code § 123120); enforcement expenses including attorney's fees under Evid. Code § 1158(d); licensing consequences and infractions for willful violations (§ 123110(h)); administrative enforcement by the Office for Civil Rights for HIPAA access (Roadmap 128.1). A qualifying § 56.35 claim involving the specified unauthorized uses or disclosures and resultant economic loss or personal injury can support its statutory compensatory and limited additional remedies. Separately, § 56.36(b) may permit $1,000 nominal damages for a negligent release without proof of actual damages, or actual damages if any; that still requires covered-entity status and a qualifying confidentiality violation, as explained in J.M. (2026). Section 56.36(c) administrative fines/civil penalties are not automatically a patient's damages award. HIPAA OCR administrative enforcement is not an independent private HIPAA damages action. The remedies matrix (096.2) should be checked for consistency rather than treating these routes as cumulative by default.

Discovery#

After suit, the records statutes give way to the discovery rules: requests for production, subpoenas to non-parties with the consumer-records protections, entity depositions of the records custodian, the HIPAA qualified protective order, and the audit trail and version history in native form with metadata (Roadmap 084; Roadmap 038 for the employment counterpart). The pre-suit requests matter because they fix what the custodian produced as "the record" before litigation began; a later production that differs is itself evidence. Analytical inference.

CFMG/Wellpath-specific relevance#

Why this may matter in a CFMG/Wellpath setting. Public records describe a model in which counties contract with private entities to provide jail health services, and in which the contracting entity, its affiliates and the professional corporations that employ clinicians may differ (Roadmaps 003, 004). In that model the "health care provider" that maintains a patient's chart, the HIPAA covered entity, and the "medical provider" to which a § 1158 authorization is presented must each be identified from documents for each period of custody; a request addressed to a brand name may reach the wrong custodian. Historical source-A identity assertions, not newly re-authenticated bankruptcy findings: the inherited authority register AR-B071/AR-B12 describes California Forensic Medical Group, Inc. separately from the Wellpath-debtor entity styled Wellpath CFMG, Inc., and associates the latter with Case No. 24-90556 in jointly administered No. 24-90533 (Bankr. S.D. Tex.). This targeted records-law review did not examine the debtor schedules, confirmation order or current docket. No debtor/nondebtor or release conclusion may be promoted from the inherited assertion without docket-matched evidence, exact corporate names and the relevant effective-date documents. A records request is not a lawsuit, but any action to enforce access against an entity in the Wellpath corporate family requires checking Roadmaps 090/091 first. Whether a county contract assigns ownership or custody of health records, and what happens to them when a contractor changes, is answered by the contract itself, obtainable as a public record (Roadmaps 086, 087). Nothing here states that any entity withheld, altered, lost or improperly disclosed any record.

Primary authorities#

Related roadmaps#

003, 004, 007, 008, 038, 040, 042, 043, 047, 064, 065, 066, 075, 078, 082, 084, 085, 086, 087, 090, 091, 093, 096.2, 101, 109, 114, 128.1, 132, 133.

Companion worksheet#

Worksheet 109 (custody, medical, medication, referral, grievance and emergency records) is the inventory: one row per record family, with custodian, period, statutory route, date requested, date received and record key. Worksheet 114 (preservation and records distinction) records the preservation demands and the K items. Worksheet 101 identifies the custodian entity for each period, and Worksheet 111 applies where the patient died. The dedicated companion is Worksheet 123 (Public Records, Oversight and Contract Requests Worksheet) for requests to public agencies; Worksheet 122 (Heirs, Successors and Family Records Worksheet) can carry the role documentation — who is acting, in which role, on what document — because the same family can hold different roles for the access statute, the CMIA, HIPAA, § 1158 and the lawsuit.

What this page cannot do#

It cannot obtain any record, decide whether any custodian is a "health care provider," a "medical provider" or a covered entity, determine any person's probate role, say whether any record was altered, or compute any period. It cannot authorize anyone to access a jail, contractor, hospital or vendor system, and it does not. It explains the routes so that requests are made to the right custodian, in the right role, in the right form, before the records that matter most — the audit data and the video — are lost.

Private 2026-10-17 verification annotation (not a public readiness label): Targeted Supreme Court/CMIA, § 123130, § 164.528 and Part 2 propositions were corrected above. This is a noncanonical source-A candidate: competing source-B body and namespace identities, Roadmap 051 revision, California official-text/negative-treatment citator review, current contracts/debtor identity, privacy/privilege, LEAP cross-references, clinical and counsel approval remain separate OPEN gates. No finding of wrongdoing is made and no existing published page is changed.