Cal. Health & Safety Code § 1364.5

(a) On or before July 1, 2001, every health care service plan shall file with the director a copy of their policies and procedures to protect the security of patient medical information to ensure compliance with the Confidentiality of Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code). Any amendment to the policies and procedures shall be filed in accordance with Section 1352.
(b) On and after July 1, 2001, every health care service plan shall, upon request, provide to enrollees and subscribers a written statement that describes how the contracting organization or health care service plan maintains the confidentiality of medical information obtained by and in the possession of the contracting organization or the health care service plan.
(c) The statement required by subdivision (b) shall be in at least 12-point type and meet the following requirements:
1. (1) The statement shall describe how the contracting organization or health care service plan protects the confidentiality of medical information pursuant to this article and inform patients or enrollees and subscribers that any disclosure of medical information beyond the provisions of the law is prohibited.
2. (2) The statement shall describe the types of medical information that may be collected and the type of sources that may be used to collect the information, the purposes for which the contracting organization or plan will obtain medical information from other health care providers.
3. (3) The statement shall describe the circumstances under which medical information may be disclosed without prior authorization, pursuant to Section 56.10 of the Civil Code.
4. (4) The statement shall describe how patients or enrollees and subscribers may obtain access to medical information created by and in the possession of the contracting organization or health care service plan, including copies of medical information.
(d) On and after July 1, 2001, every health care service plan shall include in its evidence of coverage or disclosure form the following notice, in 12-point type:
A STATEMENT DESCRIBING (NAME OR PLAN OR “OUR”) POLICIES AND PROCEDURES FOR PRESERVING THE CONFIDENTIALITY OF MEDICAL RECORDS IS AVAILABLE AND WILL BE FURNISHED TO YOU UPON REQUEST.