Back to main website
(916) 770-4050

Who we train

The federal rules are the same for everyone. The risks are not. Pick your type of practice or business to see what your staff need, then check what your state adds on top.

Pick your type of practice or business

Your state

HIPAA is the floor. Your state may sit above it.

The federal training is identical wherever you practice, and we sell in all fifty states. What changes is the state-law section, because some states go further than HIPAA — and where they do, the state law is what you have to meet.

In California, the patient can sue you directly

California has its own medical privacy law — the Confidentiality of Medical Information Act — and it differs from HIPAA in one way that changes your whole risk picture. A national program bought off the internet will not tell you about it.

  Federal HIPAA California CMIA
Can a patient sue you? No. They complain to the Office for Civil Rights, which decides whether to act. Yes. A private right of action — they can sue the practice directly.
Must they prove you meant it? Willfulness weighs in the penalty. No. A negligent disclosure is enough.
Does it reach your vendors? Business associates are directly liable for parts of the rules. Yes, CMIA reaches contractors too.
How fast must you notify? Without unreasonable delay, no later than 60 days from discovery. In the most expedient time possible, without unreasonable delay (Civ. Code §1798.82). Licensed clinics and health facilities: 15 business days (H&S Code §1280.15).

We are in Sacramento. When something happens at 7am on a Monday, you are calling a number answered in California, not a ticket queue three time zones away.

Questions before you buy?

Call or email the training team. A person answers, Monday to Friday, 8am to 6pm Pacific.

(916) 770-4050  ·  hipaa@comodotechnology.com