Cal. Code Regs. Tit. 11, § 824.7 - Restrictions on Use or Disclosure of Data Obtained from CURES

(a) A Delegate-User must not use, disclose, or transfer data obtained from CURES unless the use, disclosure, or transfer is consistent with all of the following:

(1) The use, disclosure, or transfer is for the same authorized purpose for which the data was originally requested under section 824.6, subdivision (b), and the disclosure or transfer is limited to the Authorizing User for whom the data was requested.

(2) The use, disclosure, or transfer complies with all applicable federal and State privacy, confidentiality, and security laws and regulations, including, but not limited to:

(A) The Confidentiality of Medical Information Act (Part 2.6 (commencing with section 56) of Division 1 of the Civil Code).

(B) The HIPAA Regulations.

(C) Health and Safety Code section 11165, subdivision (c).

(b) A Delegate-User must not sell any data obtained from CURES.

Notes

Cal. Code Regs. Tit. 11, § 824.7

Note: Authority cited: Section 11165, Health and Safety Code. Reference: Sections 11030, 11165, 11165.1, 11165.3, 11165.4, 11165.6 and 11190, Health and Safety Code.

1. New section filed 8-15-2022; operative 8/15/2022 pursuant to Government Code section 11343.4(b)(3) (Register 2022, No. 33).