Civ. Code, § 56.110

(a) Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, pharmaceutical company, contractor, or employer shall not knowingly disclose, transmit, transfer, share, or grant access to medical information in an electronic health records system or through a health information exchange that would identify an individual and that is related to an individual seeking, obtaining, providing, supporting, or aiding in the performance of an abortion that is lawful under the laws of this state to any individual or entity from another state, unless the disclosure, transmittal, transfer, sharing, or granting of access is authorized under any of the following conditions:

(1) In accordance with a valid, written authorization pursuant to Section 56.11 that clearly states that medical information on abortion or abortion-related services may be disclosed, and only to the extent and for the purposes expressly stated in the authorization.

(2) In accordance with paragraphs (2) and (3) of subdivision (c) of Section 56.10, to the extent necessary to allow responsibility for payment to be determined and payment to be made or to the extent that it is not further disclosed by the recipient in a way that would violate this part.

(3) In accordance with paragraphs (4) and (5) of subdivision (c) of Section 56.10 for the purpose of accreditation, in reviewing the competence or qualifications of health care professionals, or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges.

(4) In accordance with paragraph (7) of subdivision (c) of Section 56.10, for the purpose of bona fide research. Institutional Review Boards shall consider the potential harm to the patient and the patient’s privacy when the research uses data that contains information related to abortion or abortion-related services and the research is performed out of state.

(b) Notwithstanding subdivision (a), the content of the health records containing medical information described in subdivision (a) shall be disclosed to any of the following:

(1) A patient, or their personal representative, consistent with the Patient Access to Health Records Act (Chapter 1 (commencing with Section 123100) of Part 1 of Division 106 of the Health and Safety Code).

(2) In response to an order of a California or federal court, but only to the extent clearly stated in the order and consistent with Section 1543 of the Penal Code, if applicable, and only if all information about the patient’s identity and records are protected from public scrutiny through mechanisms, including, but not limited to, a sealed proceeding or court record.

(3) When expressly required by federal law that preempts California law, but only to the extent expressly required.

(c) Nothing in this section shall prohibit a provider of health care, health care service plan, pharmaceutical company, contractor, or employer from cooperating or complying with the investigation of activity that is punishable as a crime under the laws of California, and that took place in California.

(d) A provider of health care, as defined in Section 56.05, shall not be subject to liability for damages or to civil or enforcement actions, including disciplinary actions, fines, or penalties, for failure to meet the requirements of this section before January 31, 2027, if the provider of health care is working diligently and in good faith to come into compliance with this section.