Cal. Health & Safety Code § 103206.2

(a)
1. (1) In granting access to qualified researchers or a public health authority pursuant to subdivision (c) of Section 103206.1, the center shall only grant access to the minimum amount of personal information necessary for an approved project or access to a dataset designed for an approved purpose.
2. (2) Each person who accesses or obtains personal information on behalf of a qualified researcher or public health authority shall sign a data use agreement.
3. (3) The data use agreement shall prohibit the recipient from further disclosure of the personal information received that is not otherwise expressly permitted by federal or state law.
4. (4) Violation of a data use agreement entered into pursuant to paragraph (2) shall be considered a violation of Section 1798.56 of the Civil Code and, if applicable, Section 1798.57 of the Civil Code.
(b) Access to personal information by qualified researchers shall be permissible only if the following requirements are met:
1. (1) If the personal information does not include any of the direct personal identifiers listed in Section 164.514(e) of Title 45 of the Code of Federal Regulations, access may be provided to qualified researchers for research and analysis purposes consistent with intent identified in subdivision (h) of Section 130201.
2. (2) If the personal information includes any of the direct personal identifiers listed in Section 164.514(e) of Title 45 of the Code of Federal Regulations, access may be provided only to qualified researchers for research projects that offer significant opportunities to achieve the center’s intent identified in subdivision (h) of Section 130201 and shall meet all of the following criteria:
  1. (A) The project has been approved by the Committee for the Protection of Human Subjects pursuant to subdivision (t) of Section 1798.24 of the Civil Code.
  2. (B) The requester has documented expertise with privacy protection and with the analysis of large sets of confidential information.
  3. (C) The research shall be made available to the center.