to the contrary, the information may be disclosed to a sponsor, insurer, or administrator of a group or individual insured or uninsured plan or policy that the patient seeks coverage by or benefits from, if the information was created by the provider of health care or health care service plan as the result of services conducted at the specific prior written request and expense of the sponsor, insurer, or administrator for the purpose of evaluating the application for coverage or benefits.
(10) The information may be disclosed to a health care service plan by providers of health care that contract with the health care service plan and may be transferred among providers of health care that contract with the health care service plan, for the purpose of administering the health care service plan. Medical information shall not otherwise be disclosed by a health care service plan except in accordance with this part.
(11) This part does not prevent the disclosure by a provider of health care or a health care service plan to an insurance institution, agent, or support organization, subject to Article 6.6 (commencing with Section 791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code, of medical information if the insurance institution, agent, or support organization has complied with all of the requirements for obtaining the information pursuant to Article 6.6 (commencing with Section 791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code.
(12) The information relevant to the patient’s condition, care, and treatment provided may be disclosed to a probate court investigator in the course of an investigation required or authorized in a conservatorship proceeding under the Guardianship-Conservatorship Law as defined in Section 1400 of the Probate Code, or to a probate court investigator, probation officer, or domestic relations investigator engaged in determining the need for an initial guardianship or continuation of an existing guardianship.
(13) The information may be disclosed to an organ procurement organization or a tissue bank processing the tissue of a decedent for transplantation into the body of another person, but only with respect to the donating decedent, for the purpose of aiding the transplant. For the purpose of this paragraph, “tissue bank” and “tissue” have the same meanings as defined in Section 1635 of the Health and Safety Code.
(14) The information may be disclosed when the disclosure is otherwise specifically authorized by law, including, but not limited to, the voluntary reporting, either directly or indirectly, to the federal Food and Drug Administration of adverse events related to drug products or medical device problems, or to disclosures made pursuant to subdivisions (b) and (c) of Section 11167 of the Penal Code by a person making a report pursuant to Sections 11165.9 and 11166 of the Penal Code, provided that those disclosures concern a report made by that person.
(15) Basic information, including the patient’s name, city of residence, age, sex, and general condition, may be disclosed to a state-recognized or federally recognized disaster relief organization for the purpose of responding to disaster welfare inquiries.
(16) The information may be disclosed to a third party for purposes of encoding, encrypting, or otherwise anonymizing data. However, no information so disclosed shall be further disclosed by the recipient in a way that would violate this part, including the unauthorized manipulation of coded or encrypted medical information that reveals individually identifiable medical information.
(17) For purposes of disease management programs and services as defined in Section 1399.901 of the Health and Safety Code, information may be disclosed as follows: (A) to an entity contracting with a health care service plan or the health care service plan’s contractors to monitor or administer care of enrollees for a covered benefit, if the disease management services and care are authorized by a treating physician, or (B) to a disease management organization, as defined in Section 1399.900 of the Health and Safety Code, that complies fully with the physician authorization requirements of Section 1399.902 of the Health and Safety Code, if the health care service plan or its contractor provides or has provided a description of the disease management services to a treating physician or to the health care service plan’s or contractor’s network of physicians. This paragraph does not require physician authorization for the care or treatment of the adherents of a well-recognized church or religious denomination who depend solely upon prayer or spiritual means for healing in the practice of the religion of that church or denomination.
(18) The information may be disclosed, as permitted by state and federal law or regulation, to a local health department for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events, including, but not limited to, birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions, as authorized or required by state or federal law or regulation.
(19) The information may be disclosed, consistent with applicable law and standards of ethical conduct, by a psychotherapist, as defined in Section 1010 of the Evidence Code, if the psychotherapist, in good faith, believes the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a reasonably foreseeable victim or victims, and the disclosure is made to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat.
(20) The information may be disclosed as described in Section 56.103.
(21) (A) The information may be disclosed to an employee welfare benefit plan, as defined under Section 3(1) of the Employee Retirement Income Security Act of 1974 (29 U.S.C. Sec. 1002(1)), which is formed under Section 302(c)(5) of the Taft-Hartley Act (29 U.S.C. Sec. 186(c)(5)), to the extent that the employee welfare benefit plan provides medical care, and may also be disclosed to an entity contracting with the employee welfare benefit plan for billing, claims management, medical data processing, or other administrative services related to the provision of medical care to persons enrolled in the employee welfare benefit plan for health care coverage, if all of the following conditions are met:
(I) The disclosure is for the purpose of determining eligibility, coordinating benefits, or allowing the employee welfare benefit plan or the contracting entity to advocate on the behalf of a patient or enrollee with a provider, a health care service plan, or a state or federal regulatory agency.
(II) The request for the information is accompanied by a written authorization for the release of the information submitted in a manner consistent with subdivision (a) and Section 56.11.
(III) The disclosure is authorized by and made in a manner consistent with the Health Insurance Portability and Accountability Act of 1996 (Public Law 104–191).
(IV) Any information disclosed is not further used or disclosed by the recipient in any way that would directly or indirectly violate this part or the restrictions imposed by Part 164 of Title 45 of the Code of Federal Regulations, including the manipulation of the information in any way that might reveal individually identifiable medical information.
(B) For purposes of this paragraph, Section 1374.8 of the Health and Safety Code shall not apply.
(22) Information may be disclosed pursuant to subdivision (a) of Section 15633.5 of the Welfare and Institutions Code by a person required to make a report pursuant to Section 15630 of the Welfare and Institutions Code, provided that the disclosure under subdivision (a) of Section 15633.5 concerns a report made by that person. Covered entities, as they are defined in Section 160.103 of Title 45 of the Code of Federal Regulations, shall comply with the requirements of the Health Insurance Portability and Accountability Act (HIPAA) privacy rule pursuant to subsection (c) of Section 164.512 of Title 45 of the Code of Federal Regulations if the disclosure is not for the purpose of public health surveillance, investigation, intervention, or reporting an injury or death.
(d) Except to the extent expressly authorized by a patient, enrollee, or subscriber, or as provided by subdivisions (b) and (c), a provider of health care, health care service plan, contractor, or corporation and its subsidiaries and affiliates shall not intentionally share, sell, use for marketing, or otherwise use medical information for a purpose not necessary to provide health care services to the patient.
(e) Except to the extent expressly authorized by a patient or enrollee or subscriber or as provided by subdivisions (b) and (c), a contractor or corporation and its subsidiaries and affiliates shall not