Civil Code 1798.83(a) (2003; amended by SB 1108, 2005)

With some exceptions, if a business has an established business relationship with a customer and has within the immediately preceding calendar year disclosed personal information, including medical conditions and drugs, therapies, or medical products/equipment used, to third parties that used the personal information for direct marketing purposes, that business shall, upon request from the customer, provide to the customer free of charge: (1) a list of the categories of personal information disclosed by the business to third parties for the third parties' direct marketing purposes during the immediately preceding calendar year; and (2) the names and addresses of the third parties and in some cases, examples of the products or services marketed, sufficient to give the customer a reasonable indication of the nature of the third parties' business.

Civil Code 1798.91 (2004)

A business may not request medical information for marketing purposes unless the business discloses the marketing purpose, and gains the consent of the data subject or the subject's authorized representative prior to obtaining the medical information. The section also lays out requirements for the formatting, readability of written consent forms.

Civil Code 56.05 (1981; amended by SB 19, 1999; SB 2094, 2000; AB 2191, 2002; AB 715, 2003; SB 138, 2013)

The CMIA defines the following terms: health care service plan; authorization; authorized recipient; contractor; licensed health care professional; marketing; medical information; patient; pharmaceutical company; and provider of health care.

Civil Code 56.10(d)

Health care providers, health care service plans, contractors, and corporations shall not intentionally use medical information for marketing or any purpose not necessary to provide health care services to the patient unless otherwise authorized by patient.

Insurance Code 791.13 (1980)

Disclosure for marketing purposes of insurance related medical records is permissible as long as the subject is given an opportunity to refuse and consents with written authorization. The information's recipient must also agree to use the medical information solely for marketing purposes. Materials disclosed that include the individual's identity are to be returned or destroyed after use.

Insurance Code 791.13(k) (1981; amended by AB 470, 2009)

An insurance institution, agent, or insurance-support organization may disclose personal or privileged information about an individual collected or received in connection with an insurance transaction to a person whose only use of the information will be in connection with the marketing of a product or service, provided: (1) no medical-record information, privileged information, or personal information relating to an individual's character, personal habits, mode of living, or general reputation is disclosed, and no classification derived from the information is disclosed; or (2) the individual has been given an opportunity to indicate that he or she does not want personal information disclosed for marketing purposes and made no indication that he or she does not want the information disclosed; and (3) the recipient agrees to only use the information in connection with the marketing of a product or service.