Medical information.

Existing law requires a clinic, health facility, home health agency, or hospice to prevent unlawful or unauthorized access to, and use or disclosure of, patients' medical information, as defined. Existing law requires the clinic, health facility, home health agency, or hospice to report any unlawful or unauthorized access to, or use or disclosure of, a patient's medical information to the State Department of Public Health and to the affected patient or the patient's representative no later than 5 business days after the unlawful or unauthorized access, use, or disclosure has been detected. Existing law requires that the report to the patient or the patient's representative be made to that…