SECTIONS 56.20-56.245

56.20.  (a) Each employer who receives medical information shallestablish appropriate procedures to ensure the confidentiality andprotection from unauthorized use and disclosure of that information.These procedures may include, but are not limited to, instructionregarding confidentiality of employees and agents handling filescontaining medical information, and security systems restrictingaccess to files containing medical information. (b) No employee shall be discriminated against in terms orconditions of employment due to that employee's refusal to sign anauthorization under this part. However, nothing in this section shallprohibit an employer from taking such action as is necessary in theabsence of medical information due to an employee's refusal to signan authorization under this part. (c) No employer shall use, disclose, or knowingly permit itsemployees or agents to use or disclose medical information which theemployer possesses pertaining to its employees without the patienthaving first signed an authorization under Section 56.11 or Section56.21 permitting such use or disclosure, except as follows: (1) The information may be disclosed if the disclosure iscompelled by judicial or administrative process or by any otherspecific provision of law. (2) That part of the information which is relevant in a lawsuit,arbitration, grievance, or other claim or challenge to which theemployer and employee are parties and in which the patient has placedin issue his or her medical history, mental or physical condition,or treatment may be used or disclosed in connection with thatproceeding. (3) The information may be used only for the purpose ofadministering and maintaining employee benefit plans, includinghealth care plans and plans providing short-term and long-termdisability income, workers' compensation and for determiningeligibility for paid and unpaid leave from work for medical reasons. (4) The information may be disclosed to a provider of health careor other health care professional or facility to aid the diagnosis ortreatment of the patient, where the patient or other personspecified in subdivision (c) of Section 56. 21 is unable to authorizethe disclosure. (d) If an employer agrees in writing with one or more of itsemployees or maintains a written policy which provides thatparticular types of medical information shall not be used ordisclosed by the employer in particular ways, the employer shallobtain an authorization for such uses or disclosures even if anauthorization would not otherwise be required by subdivision (c).56.21.  An authorization for an employer to disclose medicalinformation shall be valid if it complies with all of the following: (a) Is handwritten by the person who signs it or is in a typefaceno smaller than 14-point type. (b) Is clearly separate from any other language present on thesame page and is executed by a signature that serves no purpose otherthan to execute the authorization. (c) Is signed and dated by one of the following: (1) The patient, except that a patient who is a minor may onlysign an authorization for the disclosure of medical informationobtained by a provider of health care in the course of furnishingservices to which the minor could lawfully have consented under Part1 (commencing with Section 25) or Part 2.7 (commencing with Section60) of Division 1. (2) The legal representative of the patient, if the patient is aminor or incompetent. However, authorization may not be given underthis subdivision for the disclosure of medical information thatpertains to a competent minor and that was created by a provider ofhealth care in the course of furnishing services to which a minorpatient could lawfully have consented under Part 1 (commencing withSection 25) or Part 2.7 (commencing with Section 60) of Division 1. (3) The beneficiary or personal representative of a deceasedpatient. (d) States the limitations, if any, on the types of medicalinformation to be disclosed. (e) States the name or functions of the employer or personauthorized to disclose the medical information. (f) States the names or functions of the persons or entitiesauthorized to receive the medical information. (g) States the limitations, if any, on the use of the medicalinformation by the persons or entities authorized to receive themedical information. (h) States a specific date after which the employer is no longerauthorized to disclose the medical information. (i) Advises the person who signed the authorization of the rightto receive a copy of the authorization.56.22.  Upon demand by the patient or the person who signed anauthorization, an employer possessing the authorization shall furnisha true copy thereof.56.23.  An employer that discloses medical information pursuant toan authorization required by this chapter shall communicate to theperson or entity to which it discloses the medical information anylimitations in the authorization regarding the use of the medicalinformation. No employer that has attempted in good faith to complywith this provision shall be liable for any unauthorized use of themedical information by the person or entity to which the employerdisclosed the medical information.56.24.  Nothing in this part shall be construed to prevent a personwho could sign the authorization pursuant to subdivision (c) ofSection 56.21 from cancelling or modifying an authorization. However,the cancellation or modification shall be effective only after theemployer actually receives written notice of the cancellation ormodification.56.245.  A recipient of medical information pursuant to anauthorization as provided by this chapter may not further disclosesuch medical information unless in accordance with a newauthorization that meets the requirements of Section 56. 21, or asspecifically required or permitted by other provisions of thischapter or by law.