Cal. Health & Safety Code § 121026

(a) Notwithstanding subdivision (f) of Section 120980, Section 121010, subdivision (i) of Section 121022, subdivision (f) of Section 121025, Section 121115, and Section 121280, the State Department of Public Health and qualified entities may share with each other health records involving the diagnosis, care, and treatment of human immunodeficiency virus (HIV) or acquired immunodeficiency syndrome (AIDS) related to a beneficiary enrolled in federal Ryan White Act funded programs who may be eligible for services under the federal Patient Protection and Affordable Care Act (Public Law 111-148), as amended by the federal Health Care and Education Reconciliation Act of 2010 (Public Law 111-152). The qualified entities, who shall be covered entities under the federal Health Insurance Portability and Accountability Act (Public Law 104-191) and the final regulations issued pursuant to the act by the United States Department of Health and Human Services (45 C.F.R. Parts 160 and 164), may share records only for the purpose of enrolling the beneficiary in Medi-Cal, the bridge programs, Medicaid expansion programs, and any insurance plan certified by the California Health Benefit Exchange established pursuant to Title 22 (commencing with Section 100500) of the Government Code, or any other programs authorized under the federal Patient Protection and Affordable Care Act (Public Law 111-148), and for the purpose of continuing their access to those programs and plans without disruption.
(b) The information provided by the State Department of Public Health pursuant to this section shall be limited to only the information necessary for the purposes of this section and shall not include HIV or AIDS surveillance data. This information shall not be further disclosed by a qualified entity, except to any or all of the following as necessary for the purposes of this section:
1. (1) The person who is the subject of the record or to their guardian or conservator.
2. (2) The provider of health care for the person with HIV or AIDS to whom the information pertains.
3. (3) The Office of AIDS within the State Department of Public Health.
(c) For purposes of this section, the following definitions shall apply:
1. (1) “Contractor” means any person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care.
2. (2) “Provider of health care” means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; any person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; any person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; any clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code.
3. (3) “Qualified entity” means any of the following:
  1. (A) The State Department of Health Care Services.
  2. (B) The California Health Benefit Exchange established pursuant to Title 22 (commencing with Section 100500) of the Government Code.
  3. (C) Medi-Cal managed care plans.
  4. (D) Health plans participating in the Bridge Program.
  5. (E) Health plans offered through the Exchange.
  6. (F) County health departments delivering HIV or AIDS health care services.
(d) Notwithstanding any other law, information shared pursuant to this section shall not be disclosed, discoverable, or compelled to be produced in any civil, criminal, administrative, or other proceeding.
(e) This section shall be implemented only to the extent permitted by federal law. All employees and contractors of a qualified entity who have access to confidential HIV-related medical records pursuant to this section shall be subject to, and all information shared pursuant to this section shall be protected in accordance with, the federal Health Insurance Portability and Accountability Act (Public Law 104-191) and the final regulations issued pursuant to that act by the United States Department of Health and Human Services (45 C.F.R. Parts 160 and 164), the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code), and the Insurance Information and Privacy Protection Act (Article 6.6 (commencing with Section 791) of Part 2 of Division 1 of the Insurance Code).