Cal. Health & Safety Code § 123148

(a) Notwithstanding any other law, a health care professional at whose request a test is performed shall provide or arrange for the provision of the results of a test to the patient who is the subject of the test if so requested by the patient, in oral or written form. The results shall be disclosed in plain language and in oral or written form, except the results may be disclosed in electronic form if requested by the patient unless deemed inappropriate by the health care professional who requested the test. The telephone shall not be considered an electronic form of disclosing test results subject to the limits on electronic disclosure of test results for the purpose of this section.
(b)
1. (1) Consent of the patient to receive their test results by internet posting or other electronic means shall be obtained in a manner consistent with the requirements of Section 56.10 or 56.11 of the Civil Code. In the event that a health care professional arranges for the provision of test results by internet posting or other electronic manner, the results shall be disclosed to a patient in a reasonable time period. Access to test results shall be restricted by the use of a secure personal identification number when the results are disclosed to a patient by internet posting or other electronic manner.
2. (2) Paragraph (1) shall not prohibit direct communication by internet posting or the use of other electronic means to disclose test results by a treating health care professional who ordered the test for their patient or by a health care professional acting on behalf of, or with the authorization of, the treating health care professional who ordered the test.
(c) When a patient requests access to their test results by internet posting, the health care professional shall advise the patient of any charges that may be assessed directly to the patient or insurer for the service and that the patient may call the health care professional for a more detailed explanation of the laboratory test results when delivered.
(d) The electronic disclosure of test results under this section shall be in accordance with any applicable federal law governing privacy and security of electronic personal health records. However, any state statute that governs privacy and security of electronic personal health records, shall apply to test results under this section and shall prevail over federal law if federal law permits.
(e) The test results to be reported to the patient pursuant to this section shall be recorded in the patient’s medical record, and shall be reported to the patient within a reasonable time period after the test results are received by the health care professional who requested the test.
(f) Notwithstanding subdivision (a), unless the patient requests the disclosure, the health care professional deems this disclosure as an appropriate means, and a health care professional has first discussed in person, by telephone, or by any other means of oral communication, the test results with the patient, in compliance with any other applicable laws, none of the following test results and any other related results shall be disclosed to a patient by internet posting or other electronic means:
1. (1)
  1. (A) A positive HIV test, unless an HIV test subject is anonymously tested and the test result is posted on a secure internet website and can only be viewed with the use of a secure code that can access only a single set of test results and that is provided to the patient at the time of testing. The test result shall be posted only if there is no link to any information that identifies or refers to the subject of the test and the information required pursuant to subdivision (h) of Section 120990 is provided.
  2. (B) Subparagraph (A) does not prevent the disclosure of HIV test results, including viral load and CD4 count test results, to a patient living with HIV by secure internet website or other electronic means if the patient has previously been informed about the results of a positive HIV test pursuant to the requirements of this section.
2. (2) Presence of antigens indicating a hepatitis infection.
3. (3) Abusing the use of drugs.
4. (4) Test results related to routinely processed tissues and imaging scans that reveal a new or recurrent malignancy.
(g) Patient identifiable test results and health information that have been provided under this section shall not be used for any commercial purpose without the consent of the patient, obtained in a manner consistent with the requirements of Section 56.11 of the Civil Code. In no event shall patient identifiable HIV-related test results and health information disclosed in this section be used in violation of subdivision (f) of Section 120980.
(h) A third party to whom test results are disclosed pursuant to this section shall be deemed a provider of administrative services, as that term is used in paragraph (3) of subdivision (c) of Section 56.10 of the Civil Code, and shall be subject to all limitations and penalties applicable to that section.
(i) A patient may not be required to pay a cost, or be charged a fee, for electing to receive their test results in a manner other than by internet posting or other electronic form.
(j) A patient or their physician may revoke consent provided under this section at any time and without penalty, except to the extent that action has been taken in reliance on that consent.
(k) As used in this section, “test” applies to both clinical laboratory tests and imaging scans, such as x-rays, magnetic resonance imaging, ultrasound, or other similar technologies.
(l) As used in this section, “internet posting” includes posting to an online patient portal.