Cal. Codes » Civil Code / DIVISION 1. PERSONS / PART 2.6. CONFIDENTIALITY OF MEDICAL INFORMATION / CHAPTER 1. Definitions
California Codes

Cal. Civil Code § 56.06 (2026)

Definitions — Confidentiality Of Medical Information

✓ current as of May 2026
Find cases: SyfertCases citing this section CA-LEGleginfo.legislature.ca.gov JustiaCode on Justia CornellLII Search CasesGoogle Scholar

(a)Any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individual’s information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.

(b)Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.

(c)Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physician’s recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.

(d)Any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.

(e)Any business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including, but not limited to, laws that specifically incorporate by reference the definitions of this part.

(f)Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.

(g)Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.

Notes of Decisions
Cited in 11 cases (11 in the last 5 years), 2021–2026 · leading case: Allen v. Blackbaud Inc (D.S.C. 2021).
Sort: Relevance Newest Treatment
Allen v. Blackbaud Inc (D.S.C. 2021). · cites it 12× “” Cal. Civ. Code § 56.06 (b); see also Valerie J.”
In re Accellion, Inc. Data Breach Litig. (N.D. Cal. 2024). · cites it 2× “06(b) applies to 4 businesses that offer software to “consumers,” Cal. Civ. Code § 56.06 (b), which the Court 5 construed to mean “individual consumers.”
R.C. v. Sussex Publishers, LLC (N.D. Cal. 2025). · cites it 2× “CMIA Claim (First Cause of Action) 18 Plaintiffs allege Defendant violated California Civil Code §§ 56.06, 56.101, 56.”
Angela Cole v. Quest Diagnostics Inc (3d Cir. 2025). · cites it 2× “” Cal. Civ. Code § 56.06 (a). While at least one other court has concluded that an entity that provides “laboratory services to health care providers” is a health care provider under CMIA, Tamraz v.”
Taft v. Boston Sci. CA5 (Cal. Ct. App. 2022). “” (Civ. Code, § 56.06, subd. (a), italics added.”
Doe v. Regents of the Univ. of California (N.D. Cal. 2023). “” Cal. Civ. Code § 56.06 (b). It would be redundant for this 6 subsection to apply to health care providers, who are already subject to the same liability in other 7 subsections of the statute.”
In Re: Arthur J. Gallagher Data Breach Litig. (N.D. Ill. 2022). “3, 2021) (quoting Cal. Civ. Code § 56.06 (a)–(b)); see [17] at 38–39.”
C.M. v. BetterHelp, Inc. (N.D. Cal. 2024). “” Plaintiffs invoke the definitions in Cal. Civ. Code §§ 56.06 (a), (b), (d), and 56.”
Harrill v. Emanuel Med. Ctr. (E.D. Cal. 2025). “…Constitution, Art. I § 1; (3) violation of the California Confidentiality of Medical 8 Information Act (“CMIA”), California Civil Code §§ 56.06 et seq.; (4) violation of the California 9 Invasion of Privacy Act (“CIPA”), California Penal Code §§ 630 et seq.; and (5)…”
Beltran v. Doctors Med. Ctr. of Modesto (E.D. Cal. 2025). “…Constitution, Art. I § 1; (3) violation of the California Confidentiality of Medical 8 Information Act (“CMIA”), California Civil Code §§ 56.06 et seq.; (4) violation of the California 9 Invasion of Privacy Act (“CIPA”), California Penal Code §§ 630 et seq.; and (5)…”
J.M. v. Illuminate Educ., Inc. (Cal. 2026). “has not stated a valid claim under the CMIA because he has not sufficiently alleged that Illuminate is a “provider of health care” within the meaning of Civil Code section 56.06. (All undesignated statutory references are to the Civil Code.”
Cal. Civil Code § 56.06(a): 2 cases
In re Accellion, Inc. Data Breach Litig. (N.D. Cal. 2024). “06(b) applies to 4 businesses that offer software to “consumers,” Cal. Civ. Code § 56.06 (b), which the Court 5 construed to mean “individual consumers.”
Angela Cole v. Quest Diagnostics Inc (3d Cir. 2025). “” Cal. Civ. Code § 56.06 (a). While at least one other court has concluded that an entity that provides “laboratory services to health care providers” is a health care provider under CMIA, Tamraz v.”
Cal. Civil Code § 56.06(d): 1 case
R.C. v. Sussex Publishers, LLC (N.D. Cal. 2025). “CMIA Claim (First Cause of Action) 18 Plaintiffs allege Defendant violated California Civil Code §§ 56.06, 56.101, 56.”
Annotations are extracted automatically from the opinions in the Syfert caselaw corpus and ranked by authority, recency, and treatment. Dots show Syfertize treatment of the citing case itself.