Health & Safety Code 120440(c) (2008)

Unless a refusal to permit record sharing is made under (e), health care providers and other agencies may disclose information specified in (c)(1) to (9) from the patient's medical record or the client's record to local health departments operating immunization information systems and to the State Department of Health Services. Local health departments and the State Department may disclose (c)(1) to (9) information to each other and to requesting health care providers taking care of a particular patient. Information under (c)(1) to (6), (8), and (9) may be disclosed to the agencies and entities listed.

Health & Safety Code 121025(c) (Added by S.B. 1360, 1995; amended by multiple subsequent amendments, the latest of which was S.B. 249, 2013)

(c) Except as provided in paragraphs (1) to (3), inclusive, any disclosure authorized by subdivision (a) or (b) shall include only the information necessary for the purpose of that disclosure and shall be made only upon agreement that the information will be kept confidential and will not be further disclosed without written authorization, as described in subdivision (a). (1) Notwithstanding any other provision of law, the following disclosures shall be authorized for the purpose of enhancing completeness of HIV/AIDS, tuberculosis, and sexually transmitted disease coinfection reporting to the federal Centers for Disease Control and Prevention (CDC): (A) The local public health agency HIV surveillance staff may further disclose the information to the health care provider who provides HIV care to the HIV-positive person who is the subject of the record for the purpose of assisting in compliance with subdivision (a) of Section 121022. (B) Local public health agency tuberculosis control staff may further disclose the information to state public health agency tuberculosis control staff, who may further disclose the information, without disclosing patient identifying information, to the CDC, to the extent the information is requested by the CDC and permitted by subdivision (b), for purposes of the investigation, control, or surveillance of HIV and tuberculosis coinfections. (C) Local public health agency sexually transmitted disease control staff may further disclose the information to state public health agency sexually transmitted disease control staff, who may further disclose the information, without disclosing patient identifying information, to the CDC, to the extent it is requested by the CDC, and permitted by subdivision (b), for the purposes of the investigation, control, or surveillance of HIV and syphilis, gonorrhea, or chlamydia coinfection. (2) Notwithstanding any other provision of law, the following disclosures shall be authorized for the purpose of facilitating appropriate HIV/AIDS medical care and treatment: (A) State public health agency HIV surveillance staff, AIDS Drug Assistance Program staff, and care services staff may further disclose the information to local public health agency staff, who may further disclose the information to the HIV-positive person who is the subject of the record, or the health care provider who provides his or her HIV care, for the purpose of proactively offering and coordinating care and treatment services to him or her. (B) AIDS Drug Assistance Program staff and care services staff in the State Department of Public Health may further disclose the information directly to the HIV-positive person who is the subject of the record or the health care provider who provides his or her HIV care, for the purpose of proactively offering and coordinating care and treatment services to him or her. (C) Local public health agency staff may further disclose acquired or developed information to the HIV-positive person who is the subject of the record or the health care provider who provides his or her HIV care for the purpose of proactively offering and coordinating care and treatment services to him or her. (3) Notwithstanding any other provision of law, for the purpose of facilitating appropriate medical care and treatment of persons coinfected with HIV, tuberculosis, and syphilis, gonorrhea, or chlamydia, local public health agency sexually transmitted disease control and tuberculosis control staff may further disclose the information to state or local public health agency sexually transmitted disease control and tuberculosis control staff, the HIV-positive person who is the subject of the record, or the health care provider who provides his or her HIV, tuberculosis, and sexually transmitted disease care. (4) For the purposes of paragraphs (2) and (3), “staff” shall not include nongovernmental entities, but shall include state and local contracted employees who work within state and local public health departments. Exceptions: disclosures authorized (1) for the purpose of enhancing completeness of HIV/AIDS, tuberculosis, and sexually transmitted disease coinfection reporting to the federal Centers for Disease Control and Prevention (CDC); (2) to facilitate appropriate HIV/AIDS medical care and treatment; (3) to facilitate appropriate medical care and treatment of persons coinfected with HIV, tuberculosis, and any STD(s), the local public health agency STD and tuberculosis control staff may further disclose the information to (i) the state or local public health agency staff, (ii) the HIV-positive person who is the subject of the record, or (iii) the health care provider who provides his or her HIV, tuberculosis, and sexually transmitted disease care.

Health & Safety Code 124119(d) (1998, amended 2006)

Data collected by the Newborn Hearing Screening tracking system obtained directly from the medical records of the newborn or infant shall be for the confidential use of the department and for other entities that the department determines are necessary to carry out the intent of the reporting and tracking system.

Health & Safety Code 130311.5 (sunsets in 2011)

CalOHii shall assume responsibilities for determining which provisions of state law concerning personal medical information are preempted by HIPAA. State entities impacted by HIPAA shall assist in determining which state laws concerning personal medical information are preempted by HIPAA and conform to all determinations made by the office regarding HIPAA. Any provision of state law pertaining to personal health information that is determined to be preempted by HIPAA shall not be applicable to the extent of that preemption.

Insurance Code 791.08 (1980)

By written request, individuals may gain access to their personal information held by an insurance institution, agent or insurance-support organization. The entities must also provide a list of entities/persons to whom this personal information was disclosed within the last two years. Medical information in the possession of insurance entities may be provided either directly to the individual or to a medical professional designated by the individual. Mental health record information shall be supplied directly to the individual, pursuant to this section, only with the approval of the qualified professional person with treatment responsibility for the condition to which the information relates.

Insurance Code 791.08(a)(3) (1980)

By written request, individuals may gain access to their personal information held by an insurance institution, agent or insurance-support organization. The entities must also provide a list of entities/persons to whom this personal information was disclosed within the last two years. Medical information in the possession of insurance entities may be provided either directly to the individual or to a medical professional designated by the individual. Mental health record information shall be supplied directly to the individual, pursuant to this section, only with the approval of the qualified professional person with treatment responsibility for the condition to which the information relates.

Labor Code 4600.6(p)

The administrative director has the authority to inspect the records, books, and papers of entities providing medical or other services to an organization, management company, solicitor, or solicitor firm.

Public Resources Code 3160 (2013; amended by SB 861, 2014)

(j)(10) The Division of Oil, Gas, and Geothermal Resources in the Department of Conservation shall develop a timely procedure to provide trade secret information in the following circumstances: (A) To an officer or employee of the division, the state, local governments, local air districts, or the United States, in connection with the official duties of that officer or employee, to a health professional under any law for the protection of health, or to contractors with the division or other government entities and their employees if, in the opinion of the division, disclosure is necessary and required for the satisfactory performance of a contract, for performance of work, or to protect health and safety. (B) To a health professional in the event of an emergency or to diagnose or treat a patient. (C) In order to protect public health, to any health professional, toxicologist, or epidemiologist who is employed in the field of public health and who provides a written statement of need. The written statement of need shall include the public health purposes of the disclosure and shall explain the reason the disclosure of the specific chemical and its concentration is required. (D) A health professional may share trade secret information about well stimulation treatments with other persons as may be professionally necessary, in order to diagnose or treat a patient, including, but not limited to, the patient and other health professionals, subject to state and federal laws restricting disclosure of medical records including the Confidentiality of Medical Information Act.

Civil Code 1798.83(a) (2003; amended by SB 1108, 2005)

With some exceptions, if a business has an established business relationship with a customer and has within the immediately preceding calendar year disclosed personal information, including medical conditions and drugs, therapies, or medical products/equipment used, to third parties that used the personal information for direct marketing purposes, that business shall, upon request from the customer, provide to the customer free of charge: (1) a list of the categories of personal information disclosed by the business to third parties for the third parties' direct marketing purposes during the immediately preceding calendar year; and (2) the names and addresses of the third parties and in some cases, examples of the products or services marketed, sufficient to give the customer a reasonable indication of the nature of the third parties' business.

Civil Code 1798.91 (2004)

A business may not request medical information for marketing purposes unless the business discloses the marketing purpose, and gains the consent of the data subject or the subject's authorized representative prior to obtaining the medical information. The section also lays out requirements for the formatting, readability of written consent forms.