BACKGROUND

Resnick is a hospital within the University of California, Los Angeles Health System (UCLA Health), and is licensed by the Department as an Acute Psychiatric Hospital. In September 2016, Kevin Y. was hired as a Clinical Care Partner at Resnick. His duties included assisting nurses and taking and recording vital signs. As part of his onboarding process, on September 8, 2016, Kevin Y. completed the online Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub.L. No. 104-191 (Aug. 21, 1996) 110 Stat. 1936) Privacy and Information Security training required by Resnick. That training included instruction on maintaining the confidentiality of protected health information, including a prohibition against storing such information on personal devices. Kevin Y. also signed the UCLA Health patient confidentiality agreement, by which he agreed to protect the privacy, confidentiality, and security of all medical records. On October 17, 2016, Kevin Y. attended orientation for new UCLA Health employees. As part of that orientation, he completed additional HIPAA and patient-privacy training. The orientation Kevin Y. completed included persistent reminders that employees were required to protect all information that could be used to identify a patient. On November 22, 2016, while entering patient vital signs into Resnick’s electronic health record system, Kevin Y. used his personal cell phone to photograph patients’ medical information. After completing his shift, he redacted the photograph to obscure the names and/or diagnoses of patients and posted the photograph to his Instagram account. Despite his redaction, the personal information of 10 patients remained partially visible, including names and medical diagnoses. A Resnick employee saw the post and informed Kevin Y. that his conduct was inappropriate. Kevin Y. subsequently deleted the

3 Instagram post. Following UCLA Health policies, the Resnick employee reported the incident to a supervisor. Kevin Y. was placed on administrative leave and ultimately terminated from Resnick as a result of the incident. UCLA Health’s Office of Compliance Services was alerted to the incident and began an investigation. That office also sent out a high-importance email to all UCLA Health employees, reiterating the duty of all employees to maintain the security and confidentiality of patient information. UCLA Health also notified the affected patients of the disclosure. No patient reported any adverse consequences as a result of Kevin Y.’s actions. After an investigation into the matter, the Department submitted to Resnick an initial, and then an amended, Statement of Deficiencies and Plan of Correction, with which Resnick timely complied. The Department subsequently issued an Unauthorized Disclosure/Breach Administrative Penalty Notice to Resnick, stating that Resnick “failed to prevent unlawful or unauthorized access to, and use or disclosure of, a patient’s medical information, as required by section 1280.15 . . . .” It also penalized Resnick $7,500 per patient, or $75,000. No penalties were assessed against Kevin Y. Resnick requested a hearing to appeal from the Department’s determination. The parties submitted a joint statement of stipulated facts for the administrative appeal, from which the foregoing recitation of underlying facts was derived. In a preliminary determination, the ALJ agreed with the Department that “the [L]egislature intended the legal standard for a violation of section 1280.15, subdivision (a), to be that of strict liability.” In its subsequent proposed decision, the ALJ first confirmed its preliminary determination that strict liability applied. Thus, any “unlawful or unauthorized access to, and use or disclosure of, patients’ medical information” constitutes a violation of section 1280.15, subdivision (a), and the Department was not required to prove Resnick failed to have proper procedures in place before it could be held responsible for a violation of that section. The ALJ did note that the Department

4 found that Resnick did not violate section 1280.18. The ALJ then stated there was no dispute that Kevin Y. accessed and disclosed patients’ private health information, and therefore Resnick was responsible. Lastly, the ALJ concluded that the Department did not abuse its discretion in levying the $75,000 penalty. On October 10, 2022, the Department adopted the ALJ’s proposed decision as its final decision. Resnick filed in the trial court a petition for a writ of administrative mandamus (Code Civ. Proc., § 1094.5) and a request for declaratory relief (Code Civ. Proc., § 1060). Resnick sought “to correct the Department’s abuse of discretion and misinterpretation of the Health and Safety Code, namely the improper ruling that Section 1280.15 was violated without any violation of Section 1280.18.” In the first cause of action, Resnick sought a writ of administrative mandate “finding that [the Department] improperly ruled [Resnick] was in violation of Section 1280.15 and that there can be no violation of Section 1280.15 without a violation of Section 1280.18.” In the second cause of action, Resnick sought a judgment declaring that, without proof of a violation of section 1280.18, the Department cannot prove a violation of section 1280.15. In a tentative ruling, the trial court noted the statutory language, which provides that a health facility “shall prevent unlawful or unauthorized access to, and use or disclosure of, patients’ medical information, as defined in Section 56.05 of the Civil Code and consistent with Section 1280.18.” (§ 1280.15, subd. (a), italics added.) It further noted that section 1280.18 provided: “Every provider of health care shall establish and implement appropriate administrative, technical, and physical safeguards to protect the privacy of a patient’s medical information. Every provider of health care shall reasonably safeguard confidential medical information from any unauthorized access or unlawful access, use, or disclosure.” (§ 1280.18, subd. (a).) The trial court agreed with Resnick that the phrase “consistent with Section 1280.18” in section 1280.15, subdivision (a), “serves to place a limitation on the duty under section 1280.15 to situations where there is also a violation of section 1280.18. A finding of violation of section 1280.15 . . . where

5 the facility had implemented appropriate safeguards in compliance with section 1280.18 would not be ‘consistent with’ section 1280.18.” The court found section 1280.15 to be unambiguous, and that the only reasonable interpretation of the plain language of that section was that a violation cannot occur without a concurrent violation of section 1280.18. Following oral argument, the trial court affirmed its tentative ruling. In an order filed November 7, 2023, the trial court granted the writ petition, granted Resnick’s request for a judgment declaring that section 1280.15, subdivision (a), cannot be violated without a concurrent violation of section 1280.18, ordered judgment entered in favor of Resnick, and ordered a peremptory writ of mandamus to issue remanding the proceedings to the Department and directing the Department to vacate its decision dated October 10, 2022, and take further action consistent with the court’s ruling. On the same date, the court filed its judgment, granting Resnick’s petition.

DISCUSSION

I Standard of Review and Statutory Interpretation In reviewing an administrative decision in proceedings on a petition for writ of administrative mandate, we review the administrative determination itself, not the trial court’s decision, for abuse of discretion. (Griego v. City of Barstow (2023) 87 Cal.App.5th 133, 139.) “In administrative mandate cases, abuse of discretion is established if the agency has not proceeded in the manner required by law, the order or decision is not supported by the findings, or the findings are not supported by substantial evidence in light of the whole record.” (Martis Camp Community Assn. v. County of Placer (2020) 53 Cal.App.5th 569, 593, fn. omitted, citing Code Civ. Proc., § 1094.5, subds. (b), (c).) Here, the parties stipulated to the underlying facts. The issue is whether

6 the Department proceeded in the manner required by law based on its interpretation of section 1280.15.2 “ ‘The proper interpretation of a statute and the application of the statute to undisputed facts are questions of law, which we . . . review de novo.’ ” (Parsons v. Estenson Logistics, LLC (2022) 86 Cal.App.5th 1260, 1265.) A reviewing court’s fundamental task in any case involving statutory construction “ ‘is to determine the Legislature’s intent so as to effectuate the law’s purpose.’ [Citation.] ‘We begin by examining the statutory language, giving it a plain and commonsense meaning. [Citation.] We do not, however, consider the statutory language in isolation; rather, we look to the entire substance of the statutes in order to determine their scope and purposes. [Citation.] That is, we construe the words in question in context, keeping in mind the statutes’ nature and obvious purposes. [Citation.] We must harmonize the various parts of the enactments by considering them in the context of the statutory [framework] as a whole. [Citation.] If the statutory language is unambiguous, then its plain meaning controls. If, however, the language supports more than one reasonable construction, then we may look to extrinsic aids, including the ostensible objects to be achieved and the legislative history.’ ” (Skidgel v. California Unemployment Ins. Appeals Bd. (2021) 12 Cal.5th 1, 14.) “Ultimately, we must ‘ “ ‘select the construction that comports most closely with the apparent intent of the Legislature, with a view to promoting rather than defeating the general purpose of the statute, and avoid an interpretation that would lead to

2 There is authority for the proposition that “ ‘an action for declaratory relief is not appropriate to review an administrative decision,’ ” and that declaratory relief “cannot be joined with a writ of mandate reviewing an administrative determination.” (City of Pasadena v. Cohen (2014) 228 Cal.App.4th 1461, 1466-1467.) Because no party raises any issue concerning the appropriateness of declaratory relief, we will not address that cause of action.

7 absurd consequences.’ ” ’ ” (City of Los Angeles v. PricewaterhouseCoopers, LLP (2024) 17 Cal.5th 46, 64.) II Plain Language Analysis The Department argues that the plain language of section 1280.15 makes clear that the section imposes strict liability for the unlawful disclosure of medical records. Conversely, Resnick argues, and amicus curiae California Hospital Association agrees, that the trial court was correct in determining that the plain and unambiguous language of section 1280.15 effectively incorporates the reasonableness standard set forth in section 1280.18. We agree with Resnick and amicus curiae. Again, the relevant language of section 1280.15 provides that a health facility “shall prevent unlawful or unauthorized access to, and use or disclosure of, patients’ medical information, as defined in Section 56.05 of the Civil Code and consistent with Section 1280.18.” (§ 1280.15, subd. (a), italics added.) The Department focuses on the “shall prevent” language, arguing that this text establishes the mandatory nature of the directive and gives rise to strict liability. Under the Department’s reading, any failure to prevent unauthorized access to, use, or disclosure of patient medical information would be a violation of section 1280.15, subdivision (a). Resnick, on the other hand, urges us to read the statute in its entirety, and to focus on the language stating that a health facility shall prevent unauthorized disclosure of medical information “consistent with Section 1280.18.” Section 1280.18 provides that providers must establish “appropriate . . . safeguards to protect the privacy of a patient’s medical information,” and must “reasonably safeguard confidential medical information . . . .” (§ 1280.18, subd. (a), italics added.) According to Resnick, the inclusion of the “consistent with Section 1280.18” language in section 1280.15 means that a health facility is liable under section 1280.15 only if it has failed to implement

8 reasonable safeguards consistent with section 1280.18, and thus this language effectively imports the reasonableness standard from section 1280.18 into section 1280.15. The “shall prevent” language does suggest, at least as a starting point, that a health facility is required to prevent unauthorized access, use, and disclosure of patients’ medical information. Courts generally interpret the word “shall” as giving rise to a mandatory duty, although, despite that presumption, a court interpreting a statute must still determine the legislative intent behind the enactment. (See California Correctional Peace Officers Assn. v. State Personnel Bd. (1995) 10 Cal.4th 1133, 1143 [there is a “presumption that the word ‘shall’ in a statute is ordinarily deemed mandatory, and ‘may’ permissive,” but, “[n]onetheless, in construing the statute, the court must ascertain the legislative intent”].) Here, our analysis of the statute does not end by reading the phrase “shall prevent” in isolation. We must consider the meaning in its larger context. (See Gerawan Farming, Inc. v. Agricultural Labor Relations Bd. (2018) 23 Cal.App.5th 1129, 1196, fn. 85 [“In construing a statute, ‘ “effect should be given, whenever possible, to the statute as a whole and to every word and clause thereof, leaving no part of the provision useless or deprived of meaning” ’ ”].) According to the Department, the phrase “consistent with Section 1280.18” (§ 1280.15, subd. (a)) “modifies ‘medical information,’ and does not modify ‘shall prevent.’ ” We do not agree with this interpretation. This portion of the subdivision requires the prevention of the unauthorized access, use, and disclosure of “medical information, as defined in Section 56.05 of the Civil Code and consistent with Section 1280.18.” (§ 1280.15, subd. (a).) Civil Code section 56.05, a definitions section, includes a definition of “ ‘Medical information.’ ” (Civ. Code, § 56.05, subd. (j).) Thus, Civil Code section 56.05 furnishes the definition of “medical information” as used in section 1280.15. Nothing in section 1280.18 purports to define or elaborate on “medical information.” Rather, that section sets forth requirements that health care providers

9 implement appropriate safeguards to protect the privacy of patient medical information and reasonably safeguard confidential medical information. (§ 1280.18, subd. (a).) There is no definition, description, or consideration of “medical information” in section 1280.18 to which section 1280.15 could be referring in specifying “and consistent with Section 1280.18.” (§ 1280.15, subd. (a).) Because section 1280.18 does not define or discuss “medical information,” we reject as unreasonable and contrary to the plain language of the statutory scheme the Department’s interpretation that the qualifier “consistent with Section 1280.18” in section 1280.15, subdivision (a), modifies “medical information.” Conversely, given the substance of section 1280.18, subdivision (a), requiring that health care providers implement appropriate safeguards to protect the privacy of patient medical information and reasonably safeguard confidential medical information, it is reasonable to interpret the provision of section 1280.15 requiring consistency with section 1280.18 as modifying the requirement that health facilities “shall prevent” improper use or disclosure of medical information. (§ 1280.15, subd. (a).) This reading would be functionally the same as stating that a health facility “shall prevent, consistent with section 1280.18, unlawful or unauthorized access to, and use or disclosure of, patients’ medical information, as defined in Section 56.05 of the Civil Code.” We find this to be the most reasonable reading of the statute’s plain language. We also are not persuaded by the Department’s arguments that the “ ‘consistent with Section 1280.18’ ” language serves to clarify “that sections 1280.15 and 1280.18 both concern the same types of medical information,” or that “the two statutes are complementary in how they protect medical information.” Both statutes do reference medical information. However, we conclude there could be no need to include the language “consistent with Section 1280.18” to clarify that both statutes concern medical information or even the same type of medical information, or that they are “complementary in how they protect medical information.” Such a provision would be

10 wholly superfluous and of no operative effect. There is no need for section 1280.15 to specify that a health facility shall prevent unauthorized disclosure of medical information that is consistent with the type of medical information that is also referenced in section 1280.18. While the Department disagrees, we conclude that the Department’s construction would effectively read “and consistent with Section 1280.18” out of section 1280.15, subdivision (a). “We generally must ‘ “give meaning to every word in [a] statute and . . . avoid constructions that render words, phrases, or clauses superfluous.” ’ ” (Rittiman v. Public Utilities Com. (2022) 80 Cal.App.5th 1018, 1034, fn. 10.) The Department also argues its interpretation is the only “grammatically correct reading of section 1280.15” because the phrase “as defined in Section 56.05 of the Civil Code and consistent with Section 1280.18” directly follows the term “medical information,” and is “far away from and not grammatically linked to the phrase ‘shall prevent.’ ” The first portion of that phrase clearly does refer to “medical information,” as it directly references the definition in Civil Code section 56.05. However, the mere fact that the reference to section 1280.18 is closer in the sentence to “medical information” than to “shall prevent” will not persuade us to adopt the Department’s interpretation, which we have concluded is not reasonable in the context of the statutory framework. Even if the Department’s grammatical point were correct, grammar is but a tool for use in determining legislative intent, is not itself controlling, and is certainly not a basis for impeding the effectuation of legislative intent. (Mt. Hawley Ins. Co. v. Lopez (2013) 215 Cal.App.4th 1385, 1411-1412.) The Department relies on other provisions setting forth the penalties the Department “may assess” for violations, because, according to the Department, they authorize the Department to assess a penalty “for any unlawful disclosure, without qualification.” Additionally, the Department relies on subdivision (g) of section 1280.15, which refers to the “failure to prevent” unlawful disclosures. According to the Department, the “statute’s terms such as ‘shall prevent’ and references to liability for a

11 ‘failure to prevent’ impose a strict liability standard for the unlawful disclosure of medical information.” We disagree. Nothing in these provisions addresses whether the statute is one of strict liability and do not persuade us that the conclusion we have reached is incorrect. The Department argues that, had the Legislature intended to establish a reasonableness standard, it could have done so clearly with explicit language in the statute. However, as Resnick notes, the same can be said of imposing strict liability. The mere mandate that health facilities “shall prevent” disclosure is not a conclusive indicator of strict liability when the Legislature could have used plain language to that effect. (See, e.g., § 25299.73 [the “standard of liability for any costs of corrective action recoverable pursuant to this chapter is strict liability”].) We next address the significance of the qualification that a health facility shall prevent unauthorized access to and use or disclosure of patients’ medical information, “consistent with Section 1280.18.” (§ 1280.15, subd. (a).) Again, subdivision (a) of section 1280.18 provides: “Every provider of health care shall establish and implement appropriate administrative, technical, and physical safeguards to protect the privacy of a patient’s medical information. Every provider of health care shall reasonably safeguard confidential medical information from any unauthorized access or unlawful access, use, or disclosure.” (§ 1280.18, subd. (a).) Synthesizing these sections, section 1280.15 provides that a health facility “shall prevent” unauthorized access to and use or disclosure of patients’ medical information “consistent with Section 1280.18” (§ 1280.15, subd. (a)), which, in turn, requires health care providers to “implement appropriate . . . safeguards to protect the privacy of a patient’s medical information,” and to “reasonably safeguard confidential medical information from any unauthorized access or unlawful access, use, or disclosure” (§ 1280.18, subd. (a)).

12 We agree with Resnick, amicus curiae, and the trial court that this statutory framework incorporates the standards from section 1280.18 into section 1280.15. Specifically, it requires health facilities to prevent unauthorized access to, use of, and disclosure of patients’ medical information consistent with section 1280.18 by implementing “appropriate” safeguards and “reasonably safeguard[ing]” that information. Thus, this section incorporates the “appropriate” and “reasonabl[e]” standards from section 1280.18 into section 1280.15. We therefore agree with the trial court’s conclusion that the “only reasonable interpretation” of the statutory framework “is that a violation of section 1280.15 cannot occur without a concurrent violation of section 1280.18.” As the trial court wrote, a “finding of violation of section 1280.15 . . . where the facility had implemented appropriate safeguards in compliance with section 1280.18 would not be ‘consistent with’ section 1280.18.” Thus, notwithstanding its “shall prevent” language, we find that section 1280.15 is not a strict liability statute that establishes a violation in every case of unauthorized access and use or disclosure. For an actionable violation, the health facility must have failed to comply with section 1280.18, subdivision (a). For the foregoing reasons, we conclude that the plain language of section 1280.15, subdivision (a), makes clear that this law incorporates the requirements of section 1280.18 and the “appropriate” and “reasonabl[e]” standards in that section. This interpretation effectuates the legislative intent to protect patients’ medical information while not penalizing health facilities that have undertaken all reasonable steps within their power to safeguard that information. Because we conclude that the language of section 1280.15 is plain and unambiguous, the text controls. (Lopez v. Sony Electronics, Inc. (2018) 5 Cal.5th 627, 634.) Accordingly, we need not address the Department’s arguments concerning the legislative history of section 1280.15, whether the Department’s interpretation is entitled to deference (see Western Growers Assn. v. Occupational Safety & Health Stds. Bd.

13 (2021) 73 Cal.App.5th 916, 932 [“ ‘Deference is not accorded to an administrative action which is incorrect in light of unambiguous statutory language or which is clearly erroneous or unauthorized’ ”]), the “foundational principles of administrative law” governing a licensee’s liability for the acts of its employees, or public policy.

DISPOSITION

The judgment is affirmed. Resnick shall recover its costs on appeal. (Cal. Rules of Court, rule 8.278(a)(1), (2).)

\s\ , Krause, J.

We concur:

\s\ , Hull, Acting P. J.

\s\ , Boulware Eurie, J.

14