Cal. Health and Safety Code § 1385.10

(a) (1) A health care service plan shall annually provide claims data at no charge to a large group purchaser if the large group purchaser requests the information and otherwise meets the requirements of this section. (2) The health care service plan shall provide claims data that a qualified statistician has determined are deidentified so that the claims data do not identify or do not provide a reasonable basis from which to identify an individual. If the statistician is unable to determine that the data has been deidentified, then the data that cannot be deidentified shall not be provided by the health care service plan to the large group purchaser. A health care service plan may provide the claims data in an aggregated form as necessary to comply with subdivisions (e) and (f). (b) (1) As an alternative to providing claims data required pursuant to subdivision (a), the plan shall provide, at no charge to a large group purchaser, all of the following: (A) Deidentified data sufficient for the large group purchaser to calculate the cost of obtaining similar services from other health plans and evaluate cost-effectiveness by service and disease category. (B) Deidentified aggregated patient-level data on demographics, prescribing, encounters, inpatient services, outpatient services, and any other data that is comparable to what is required of the health plan to comply with risk adjustment, reinsurance, or risk corridors pursuant to the federal Patient Protection and Affordable Care Act (Public Law 111-148), as amended by the federal Health Care and Education Reconciliation Act of 2010 (Public Law 111-152), and any rules, regulations, or guidance issued thereunder. (C) Deidentified aggregated patient-level data used to experience rate the large group, including diagnostic and procedure coding and costs assigned to each service that the plan has available. (2) The health care service plan shall obtain a formal determination from a qualified statistician that the data provided pursuant to this subdivision have been deidentified so that the data do not identify or do not provide a reasonable basis from which to identify an individual. If the statistician is unable to determine that the data has been deidentified, the health care service plan shall not provide the data that cannot be deidentified to the large group purchaser. The statistician shall document the formal determination in writing and shall, upon request, provide the protocol used for deidentification to the department. (c) Data provided pursuant to this section shall only be provided to a large group purchaser that meets both of the following conditions: (1) Is able to demonstrate its ability to comply with state and federal privacy laws. (2) Is a large group purchaser that is either an employer with an enrollment of greater than 1,000 covered lives and at least 500 covered lives enrolled with the health care service plan providing the information or a multiemployer trust with an enrollment of greater than 500 covered lives and at least 250 covered lives enrolled with the health care service plan providing the information. (d) Nothing in this section shall be construed to prohibit a plan and purchaser from negotiating the release of additional information not described in this section. (e) All disclosures of data to the large group purchaser made pursuant to this section shall comply with the federal Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191) and the federal Health Information Technology for Economic and Clinical Health Act, Title XIII of the federal American Recovery and Reinvestment Act of 2009 (Public Law 111-5), and implementing regulations. (f) All disclosures of data to the large group purchaser made pursuant to this section shall comply with the Confidentiality of Medical Information Act (Chapter 1 (commencing with Section 56) of Part 2.6 of Division 1 of the Civil Code).