Health & Saf. Code, § 128766

(a) Notwithstanding Section 128765 or any other provision of law, the department, upon request, shall disclose information collected pursuant to subdivision (g) of Section 128735 and Sections 128736 and 128737, to any California hospital and any local health department or local health officer in California as set forth in Part 3 (commencing with Section 101000) of Division 101. The department shall disclose this same information to the United States Department of Health and Human Services or any of its subsidiary agencies, including the National Center for Health Statistics or any other unit of the Centers for Disease Control and Prevention, the Agency for Healthcare Research and Quality, the Centers for Medicare and Medicaid Services, the Health Resources and Services Administration, the Indian Health Service, Tribal Epidemiology Centers, which are defined as public health authorities pursuant to the federal Indian Health Care Improvement Act (25 U.S.C. Sec. 1601 et seq.), the National Institutes of Health, or the National Cancer Institute, or the Veterans Health Care Administration within the United States Department of Veterans Affairs, for the purposes of conducting a statutorily authorized activity. All disclosures made pursuant to this section shall be consistent with the standards and limitations applicable to the disclosure of limited data sets as provided in Section 164.514 of Part 164 of Title 45 of the Code of Federal Regulations, relating to the privacy of health information.

(b) Any hospital that receives information pursuant to this section shall not disclose that information to any person or entity, except in response to a court order, search warrant, or subpoena, or as otherwise required or permitted by the federal medical privacy regulations contained in Parts 160 and 164 of Title 45 of the Code of Federal Regulations. In no case shall a hospital, contractor, or subcontractor reidentify or attempt to reidentify any information received pursuant to this section.

(c) No disclosure shall be made pursuant to this section if the director of the department has determined that the disclosure would create an unreasonable risk to patient privacy. The director shall provide a written explanation of the determination to the requester within 60 days.