Labor Code 4600.6(p)

The administrative director has the authority to inspect the records, books, and papers of entities providing medical or other services to an organization, management company, solicitor, or solicitor firm.

Health & Safety Code 120440(c) (2008)

Unless a refusal to permit record sharing is made under (e), health care providers and other agencies may disclose information specified in (c)(1) to (9) from the patient's medical record or the client's record to local health departments operating immunization information systems and to the State Department of Health Services. Local health departments and the State Department may disclose (c)(1) to (9) information to each other and to requesting health care providers taking care of a particular patient. Information under (c)(1) to (6), (8), and (9) may be disclosed to the agencies and entities listed.

Health & Safety Code 121025(c) (Added by S.B. 1360, 1995; amended by multiple subsequent amendments, the latest of which was S.B. 249, 2013)

(c) Except as provided in paragraphs (1) to (3), inclusive, any disclosure authorized by subdivision (a) or (b) shall include only the information necessary for the purpose of that disclosure and shall be made only upon agreement that the information will be kept confidential and will not be further disclosed without written authorization, as described in subdivision (a). (1) Notwithstanding any other provision of law, the following disclosures shall be authorized for the purpose of enhancing completeness of HIV/AIDS, tuberculosis, and sexually transmitted disease coinfection reporting to the federal Centers for Disease Control and Prevention (CDC): (A) The local public health agency HIV surveillance staff may further disclose the information to the health care provider who provides HIV care to the HIV-positive person who is the subject of the record for the purpose of assisting in compliance with subdivision (a) of Section 121022. (B) Local public health agency tuberculosis control staff may further disclose the information to state public health agency tuberculosis control staff, who may further disclose the information, without disclosing patient identifying information, to the CDC, to the extent the information is requested by the CDC and permitted by subdivision (b), for purposes of the investigation, control, or surveillance of HIV and tuberculosis coinfections. (C) Local public health agency sexually transmitted disease control staff may further disclose the information to state public health agency sexually transmitted disease control staff, who may further disclose the information, without disclosing patient identifying information, to the CDC, to the extent it is requested by the CDC, and permitted by subdivision (b), for the purposes of the investigation, control, or surveillance of HIV and syphilis, gonorrhea, or chlamydia coinfection. (2) Notwithstanding any other provision of law, the following disclosures shall be authorized for the purpose of facilitating appropriate HIV/AIDS medical care and treatment: (A) State public health agency HIV surveillance staff, AIDS Drug Assistance Program staff, and care services staff may further disclose the information to local public health agency staff, who may further disclose the information to the HIV-positive person who is the subject of the record, or the health care provider who provides his or her HIV care, for the purpose of proactively offering and coordinating care and treatment services to him or her. (B) AIDS Drug Assistance Program staff and care services staff in the State Department of Public Health may further disclose the information directly to the HIV-positive person who is the subject of the record or the health care provider who provides his or her HIV care, for the purpose of proactively offering and coordinating care and treatment services to him or her. (C) Local public health agency staff may further disclose acquired or developed information to the HIV-positive person who is the subject of the record or the health care provider who provides his or her HIV care for the purpose of proactively offering and coordinating care and treatment services to him or her. (3) Notwithstanding any other provision of law, for the purpose of facilitating appropriate medical care and treatment of persons coinfected with HIV, tuberculosis, and syphilis, gonorrhea, or chlamydia, local public health agency sexually transmitted disease control and tuberculosis control staff may further disclose the information to state or local public health agency sexually transmitted disease control and tuberculosis control staff, the HIV-positive person who is the subject of the record, or the health care provider who provides his or her HIV, tuberculosis, and sexually transmitted disease care. (4) For the purposes of paragraphs (2) and (3), “staff” shall not include nongovernmental entities, but shall include state and local contracted employees who work within state and local public health departments. Exceptions: disclosures authorized (1) for the purpose of enhancing completeness of HIV/AIDS, tuberculosis, and sexually transmitted disease coinfection reporting to the federal Centers for Disease Control and Prevention (CDC); (2) to facilitate appropriate HIV/AIDS medical care and treatment; (3) to facilitate appropriate medical care and treatment of persons coinfected with HIV, tuberculosis, and any STD(s), the local public health agency STD and tuberculosis control staff may further disclose the information to (i) the state or local public health agency staff, (ii) the HIV-positive person who is the subject of the record, or (iii) the health care provider who provides his or her HIV, tuberculosis, and sexually transmitted disease care.

Health & Safety Code 124119(d) (1998, amended 2006)

Data collected by the Newborn Hearing Screening tracking system obtained directly from the medical records of the newborn or infant shall be for the confidential use of the department and for other entities that the department determines are necessary to carry out the intent of the reporting and tracking system.

Health & Safety Code 130311.5 (sunsets in 2011)

CalOHii shall assume responsibilities for determining which provisions of state law concerning personal medical information are preempted by HIPAA. State entities impacted by HIPAA shall assist in determining which state laws concerning personal medical information are preempted by HIPAA and conform to all determinations made by the office regarding HIPAA. Any provision of state law pertaining to personal health information that is determined to be preempted by HIPAA shall not be applicable to the extent of that preemption.

Bus. & Prof. Code 2225

Any document relevant to the business operations of a licensee, and not involving medical records attributable to identifiable patients, may be inspected and copied where relevant to an investigation of a licensee by the Attorney General or other authorized investigators.

Civil Code 56.27

An employer that is an insurance institution, insurance agent, or insurance support organization . . . shall not be deemed to have violated Section 56.20 by disclosing medical information gathered in connection with an insurance transaction in accordance with that act.

Penal Code 11170(a) (1980; amended by AB 247, 2009)

The Department of Justice shall maintain an index of all reports of child abuse and severe neglect submitted by mandated reporters. The department shall maintain a repository of reports in the Child Abuse Central Index. Information from an inconclusive report filed by mandated reporters shall be deleted from the Child Abuse Central Index after 10 years if no subsequent report is received within that time period. If a subsequent report is received within that 10-year period, information from the prior and subsequently filed reports shall be maintained on the Child Abuse Central Index for a period of 10 years from the time the most recent report is received by the department.

Penal Code 11170(b)(1) (1980; amended by AB 247, 2009)

The Department of Justice shall immediately notify an agency that submits a report by a mandated reporter of any information relevant to the known or suspected instance of child abuse or severe neglect reported by the agency. The agency shall make that information available to the reporting health care practitioner, child custodian, appointed guardian ad litem, appointed counsel, or the appropriate licensing agency.

Penal Code 11170(b)(10) (1980; amended by AB 247, 2009)

If Child Abuse Central Index information is requested by an agency for the temporary placement of a child in an emergency situation, the Department of Justice is exempt from the requirements of accuracy, relevance, timeliness, and completeness if compliance would cause a delay in providing an expedited response to the agency's inquiry and if further delay in placement may be detrimental to the child.