(c) Any disclosures authorized by subdivision (a), (b), or this subdivision shall include only the information necessary for the purpose of that disclosure and shall be made only upon the agreement that the information will be kept confidential as described in subdivision (a). Any unauthorized further disclosure shall be subject to the penalties described in subdivision (e).

1. (1) Notwithstanding any other law, the state or local public health agency staff may further disclose the information to a health care provider who provides care to the HIV-positive person who is the subject of the record for the purpose of assisting in compliance with subdivision (a) of Section 121022.

2. (2) Notwithstanding any other law, the following disclosures are authorized for the purpose of facilitating appropriate HIV/AIDS medical care and treatment:

   1. (A) State public health agency HIV surveillance staff, HIV prevention staff, AIDS Drug Assistance Program staff, and care services staff may further disclose the information to local public health agency staff, who may further disclose the information to the HIV-positive person who is the subject of the record, or a health care provider who provides the person’s care, for the purpose of proactively offering and coordinating care and treatment services to the HIV-positive person.
   2. (B) HIV surveillance staff, HIV prevention staff, AIDS Drug Assistance Program staff, and care services staff in the State Department of Public Health may further disclose the information directly to the HIV-positive person who is the subject of the record or the health care provider who provides their HIV care, for the purpose of proactively offering and coordinating care and treatment services to them.
   3. (C) Local public health agency staff may further disclose acquired or developed information to the HIV-positive person who is the subject of the record or the health care provider who provides their HIV care for the purpose of proactively offering and coordinating care and treatment services to them.
3. (3) Notwithstanding any other law, for the purpose of facilitating appropriate case management or care coordination or delivery of medical care and treatment of persons coinfected with HIV and tuberculosis, syphilis, gonorrhea, chlamydia, hepatitis B, hepatitis C, meningococcal infection, or other reportable diseases under Section 2500 or Section 2505 of Title 17 of the California Code of Regulations, state or local public health agency staff may further disclose the information to other state or local public health agency staff, the HIV-positive person who is the subject of the record, or the HIV-positive person’s health care provider.
4. (4) For the purposes of paragraphs (2) and (3), “staff” does not include nongovernmental entities, but shall include state and local contracted employees who work within state and local public health departments.

(e)

1. (1) A person who negligently discloses the content of a confidential public health record, as defined in subdivision (c) of Section 121035, to a third party, except pursuant to a written authorization, as described in subdivision (a), or as otherwise authorized by law, shall be subject to a civil penalty in an amount not to exceed five thousand dollars ($5,000), plus court costs, as determined by the court. The penalty and costs shall be paid to the person whose record was disclosed.
2. (2) A person who willfully or maliciously discloses the content of any confidential public health record, as defined in subdivision (c) of Section 121035, to a third party, except pursuant to a written authorization, or as otherwise authorized by law, shall be subject to a civil penalty in an amount not less than five thousand dollars ($5,000) and not more than twenty-five thousand dollars ($25,000), plus court costs, as determined by the court. The penalty and costs shall be paid to the person whose confidential public health record was disclosed.
3. (3) A person who willfully, maliciously, or negligently discloses the content of a confidential public health record, as defined in subdivision (c) of Section 121035, to a third party, except pursuant to a written authorization, or as otherwise authorized by law, that results in economic, bodily, or psychological harm to the person whose confidential public health record was disclosed, is guilty of a misdemeanor, punishable by imprisonment in a county jail for a period not to exceed one year, or a fine not to exceed twenty-five thousand dollars ($25,000), or both, plus court costs, as determined by the court. The penalty and costs shall be paid to the person whose confidential public health record was disclosed.
4. (4) A person who commits an act described in paragraph (1), (2), or (3) is liable to the person whose confidential public health record was disclosed for all actual damages for economic, bodily, or psychological harm that is a proximate result of the act.
5. (5) Each violation of this section is a separate and actionable offense.
6. (6) This section does not limit or expand the right of an injured person whose confidential public health record was disclosed to recover damages under any other applicable law.