Health & Saf. Code, § 127772

(a) The Legislature finds and declares that the department performs public health activities described in Section 164.512(b) of Title 45 of the Code of Federal Regulations when carrying out activities pursuant to this chapter. Personal information collected in accordance with this chapter is necessary to carry out projects with public health purposes.

(b) All personal information obtained or maintained by the department shall be confidential and shall be subject to the following requirements:

(1) Only deidentified and aggregated information shall be included in a publicly available analysis, data product, or research.

(2) All policies and procedures developed in implementing this chapter shall provide that the privacy, security, and confidentiality of consumers’ personal information is protected, as required by the Information Practices Act of 1977 (Chapter 1 (commencing with Section 1798) of Title 1.8 of Part 4 of Division 3 of the Civil Code), and consistent with state and federal health privacy laws, including the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191) and the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code). Data shall not be disclosed until the department has developed a policy regarding the release of data.

(c) Unless otherwise specified in this chapter, personal information collected by the department from other state entities shall be exempt from the disclosure requirements of the California Public Records Act (Division 10 (commencing with Section 7920.000) of Title 1 of the Government Code), and shall not be made available except pursuant to this chapter.

(d) Any information collected or obtained pursuant to this chapter shall not be used for determinations regarding individual patient care or treatment and shall not be used for any individual eligibility or coverage decisions or similar purposes.