Cal. Health & Safety Code § 131380

(a) All data collected pursuant to this chapter shall be confidential.
(b) For any disclosure authorized by Section 131375, the disclosing entity shall only include data relevant and necessary for the approved purpose of the requested disclosure.
(c) An entity authorized pursuant to subdivisions (a) and (b) of Section 131375 that receives confidential data from the department shall do all of the following:
1. (1) Agree in writing to maintain the confidentiality of the data before confidential data is disclosed.
2. (2) Ensure that a patient’s rights to confidentiality shall not be violated in any manner.
3. (3) Not disclose the data to any other entity.
4. (4) Safeguard the confidential data from unauthorized disclosure.
5. (5) Only use the disclosed data for an approved purpose.
(d) An entity authorized pursuant to subdivision (c) of Section 131375 that receives confidential data from the department shall comply with the requirements set forth by the Center for Data Insights and Innovation in Sections 130206, 103206.1, and 103206.2.
(e) The furnishing of confidential data to an entity in accordance with this section will not expose any person, agency, or entity furnishing data to liability, and shall not be considered a waiver of any privilege or a violation of a confidential relationship.
(f)
1. (1) The department shall maintain an accurate record of all persons who are given access to confidential data. The record shall include all of the following:
  1. (A) The name of the person authorizing access.
  2. (B) The name, title, address, and organizational affiliation of the person given access.
  3. (C) The dates of access.
  4. (D) The specific purpose for which the data is to be used.
2. (2) The record of access shall be open to public inspection during normal operating hours of the department.
(g) The confidential data shall be exempt from disclosure under the California Public Records Act (Division 10 (commencing with Section 7920.000) of Title 1 of the Government Code) and from subpoena. The confidential data shall not be disclosed, discoverable, or compelled to be produced in any civil, criminal, administrative, or other proceeding, and shall not be deemed admissible as evidence in any civil, criminal, administrative, or other tribunal or court for any reason.
(h) This section does not prohibit the publication by the department of reports and statistical compilations that do not in any way identify individual cases or individual sources of information.