Your Health Data, Your Choice: Medical Records, Data Sharing, and How to Opt Out. What Health Information Exchanges Are, How They Work in California, and Your Privacy Rights
What Is a Health Information Exchange (HIE): Health Information Exchanges (HIEs) are digital networks that allow hospitals, doctors, health plans, and other healthcare entities to share patient medical records electronically. These systems are widely used across California to support care coordination, billing, and treatment decisions. Many patients are unaware that their medical records may be stored in one or more Health Information Exchanges unless they are told directly.
While HIEs are often described as tools for efficiency and continuity of care, storing personal health information in large shared databases raises legitimate privacy and ethical concerns. Many individuals are concerned about how sensitive medical information may be accessed, shared, or reused beyond their direct healthcare needs, including risks related to unauthorized access, secondary use, or data breaches.
Your Rights Under California Law: California law provides patients with meaningful control over how their medical information is shared. Under the Confidentiality of Medical Information Act (Civil Code § 56.10), patients have the right to restrict disclosure of their medical information and to withdraw consent for future disclosures, subject to limited exceptions such as medical emergencies. This means Californians may choose to opt out of participation in Health Information Exchanges.
Compared to federal HIPAA, California’s law offers stronger protections, including stricter consent requirements, broader definitions of medical information, enhanced safeguards for mental health records, and the ability for patients to pursue legal action for unauthorized disclosures. These provisions reflect California’s emphasis on patient privacy and informed choice.
Residents of other states may have similar rights under their own state privacy or medical confidentiality laws, and should check with their state health department or attorney general’s office for guidance.
Opting Out of an HIE: There is no single statewide opt-out portal. To opt out of HIE participation, individuals must contact their healthcare provider or the specific regional HIE used by that provider and submit a written opt-out request or form. Most healthcare organizations and HIEs provide opt-out information through their privacy notices, patient rights pages, or patient portals.
It is important to understand what opting out does and does not do. In most systems, opting out generally limits the sharing of information between providers through the exchange. It does not typically prevent a healthcare provider from submitting records to an HIE in the first place, but it does restrict how and by whom that information can be accessed or re-shared.
Public health disclosures may still occur regardless of an opt-out. Disclosures required or permitted by law may include certain reporting categories such as communicable disease reporting, public health surveillance, investigations, and other mandated public health functions.
- Does Opting Out Affect Emergency Care: Opting out does not generally prevent access to medical information needed in an emergency. CMIA allows limited disclosure when necessary to diagnose or treat a patient during a medical emergency.
- Opting Out for Children: Parents and legal guardians may request to opt out of HIE participation on behalf of their minor children. However, for certain medical services that California law allows minors to consent to on their own beginning at age 12, parents may not have access to those specific records, and those records may be subject to different privacy rules.
Things to Consider Before Opting Out: Opting out may affect how quickly information is shared between providers outside of emergency situations. Individuals are encouraged to discuss these implications with their healthcare providers so they can make an informed choice based on their personal priorities. Patients may change their decision at any time. An opt-out can be revoked or modified by submitting a new written request to the healthcare provider or the applicable HIE administrator.
Health Information Exchanges are encouraged by the state and healthcare systems, but participation is not mandatory. Under California law, the decision to share medical information through an HIE belongs to the patient.w, the decision to share medical information through an HIE belongs to the patient.