Bus. & Prof. Code, § 5063.3

(a) No confidential information obtained by a licensee, in their professional capacity, concerning a client or a prospective client shall be disclosed by the licensee without the written permission of the client or prospective client, except the following:

(1) Disclosures made by a licensee in compliance with a subpoena or a summons enforceable by order of a court.

(2) Disclosures made by a licensee regarding a client or prospective client to the extent the licensee reasonably believes it is necessary to maintain or defend themselves in a legal proceeding initiated by the client or prospective client.

(3) Disclosures made by a licensee in response to an official inquiry from a federal or state government regulatory agency.

(4) Disclosures made by a licensee or a licensee’s duly authorized representative to another licensee or person in connection with a proposed sale or merger of the licensee’s professional practice, provided the parties enter into a written nondisclosure agreement with regard to all client information shared between the parties.

(5) Disclosures made by a licensee to either of the following:

(A) Another licensee to the extent necessary for purposes of professional consultation.

(B) Organizations that provide professional standards review and ethics or quality control peer review.

(6) Disclosures made when specifically required by law.

(7) Disclosures specified by the board in regulation.

(b) In the event that confidential client information may be disclosed to persons or entities outside the United States of America in connection with the services provided, the licensee shall inform the client in writing and obtain the client’s written permission for the disclosure.