Ins. Code, § 10117.52

(a) No health insurance contract in existence or issued, amended, or renewed on or after January 1, 2013, between a health insurer and a provider or a supplier shall prohibit, condition, or in any way restrict the disclosure of claims data related to health care services provided to a policyholder or insured of the insurer or beneficiaries of any self-insured health coverage arrangement administered by the insurer, to a qualified entity, as defined in Section 1395kk(e)(2) of Title 42 of the United States Code. All disclosures of data made under this section shall comply with all applicable state and federal laws for the protection of the privacy and security of the data, including, but not limited to, the federal Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191) and the federal Health Information Technology for Economic and Clinical Health Act, Title XIII of the federal American Recovery and Reinvestment Act of 2009 (Public Law 111-5), and implementing regulations.

(b) For purposes of this section, the following definitions apply:

(1) “PPACA” means the federal Patient Protection and Affordable Care Act (Public Law 111-148), as amended by the federal Health Care and Education Reconciliation Act of 2010 (Public Law 111-152).

(2) “Provider” means a hospital, a skilled nursing facility, a comprehensive outpatient rehabilitation facility, a home health agency, a hospice, a clinic, or a rehabilitation agency.

(3) “Supplier” means a physician and surgeon or other health care practitioner, or an entity that furnishes health care services other than a provider.