Bus. & Prof. Code, § 26162

(a) Information identifying the names of patients, their medical conditions, or the names of their primary caregivers received and contained in records kept by the office or the department for the purposes of administering this chapter are confidential and shall not be disclosed pursuant to the California Public Records Act (Division 10 (commencing with Section 7920.000) of Title 1 of the Government Code), except as necessary for authorized employees of the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance.

(b) Information identifying the names of patients, their medical conditions, or the names of their primary caregivers received and contained in records kept by the department for the purposes of administering this chapter shall be maintained in accordance with Chapter 1 (commencing with Section 123100) of Part 1 of Division 106 of the Health and Safety Code, Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code, and other state and federal laws relating to confidential patient information.

(c) Nothing in this section precludes the following:

(1) Employees of the department notifying state or local agencies about information submitted to the agency that the employee suspects is falsified or fraudulent.

(2) Notifications from the department to state or local agencies about apparent violations of this division or applicable local ordinance.

(3) Verification of requests by state or local agencies to confirm licenses and certificates issued by the department or other state agency.

(4) Provision of information requested pursuant to a court order or subpoena issued by a court or an administrative agency or local governing body authorized by law to issue subpoenas.

(d) Information shall not be disclosed by any state or local agency beyond what is necessary to achieve the goals of a specific investigation, notification, or the parameters of a specific court order or subpoena.