Health & Saf. Code, § 130206

(a) The Legislature finds and declares that the center performs public health activities described in Section 164.512(b) of Title 45 of the Code of Federal Regulations when carrying out activities pursuant to this division. Personal information collected in accordance with this division is necessary to carry out projects with public health purposes.

(b) All personal information obtained or maintained by the center shall be confidential and shall be subject to the following requirements:

(1) Only deidentified and aggregated information shall be included in a publicly available analysis, data product, or research.

(2) All policies and procedures developed in implementing this division shall ensure that the privacy, security, and confidentiality of consumers’ personal information is protected, as required by the Information Practices Act of 1977, and consistent with state and federal health privacy laws, including the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191) and the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code), and data shall not be disclosed until the center has developed a policy regarding the release of data.

(c) Unless otherwise specified in this division, personal information collected by the center from other state entities shall be exempt from the disclosure requirements of the California Public Records Act (Division 10 (commencing with Section 7920.000) of Title 1 of the Government Code), and shall not be made available except pursuant to this division.

(d) Any information collected or obtained shall not be used for determinations regarding individual patient care or treatment and shall not be used for any individual eligibility or coverage decisions or similar purposes.