Civ. Code, § 56.21

An authorization for an employer to disclose medical information shall be valid if the authorization complies with all of the following:

(a) Is handwritten or is in a typeface no smaller than 14-point type.

(b) Is clearly separate from any other language present on the same page and is executed by a signature that serves no purpose other than to execute the authorization.

(c) Is signed, including with an electronic or handwritten signature, and dated by one of the following:

(1) The patient, except that a patient who is a minor may only sign an authorization for the disclosure of medical information obtained by a provider of health care in the course of furnishing services to which the minor could lawfully have consented under Part 4 (commencing with Section 6900) of Division 11 of the Family Code.

(2) The legal representative of the patient, if the patient is a minor or lacks the capacity to make the decision to authorize the release of medical information. However, authorization may not be given under this subdivision for the disclosure of medical information that pertains to a competent minor and that was created by a provider of health care in the course of furnishing services to which a minor patient could lawfully have consented under Part 4 (commencing with Section 6900) of Division 11 of the Family Code.

(3) The beneficiary, as defined in Section 24 of the Probate Code, or personal representative, as defined in Section 58 of the Probate Code, of a deceased patient.

(d) States the limitations, if any, on the types of medical information to be disclosed.

(e) States the name or functions of the employer or person authorized to disclose the medical information.

(f) States the names or functions of the persons or entities authorized to receive the medical information.

(g) States the limitations, if any, on the use of the medical information by the persons or entities authorized to receive the medical information.

(h) States an expiration date or event. The expiration date or event shall limit the duration of the authorization to one year or less, unless the person signing the authorization requests a specific date beyond a year or unless the authorization is related to an approved clinical trial, as defined in Section 1370.6 of the Health and Safety Code, or medical research study, in which case the authorization may extend beyond one year if the expiration date or event extends no longer than the completion of the relevant clinical trial or research study.

(i) Advises the person who signed the authorization of the right to receive a copy of the authorization.

(j) If an employer or any other entity seeks an authorization from an individual for a use or disclosure of protected health information, the employer or other entity shall provide the individual with a copy of the signed authorization and instructions on how to access additional copies or a digital version of the signed authorization.