California law mandates that you establish appropriate procedures to keep all employee medical records and information confidential and protect them from unauthorized use and disclosure. Failing to establish these procedures is a misdemeanor and allows an employee to collect monetary damages, attorneys' fees and the costs of litigation.