Cal. Health and Safety Code § 120985

(a) (1) Notwithstanding Section 120980, the results of an HIV test that identifies or provides identifying characteristics of the person to whom the test results apply may be recorded by the physician who ordered the test in the test subject’s medical record or otherwise disclosed without written authorization of the subject of the test, or the subject’s representative as set forth in Section 121020, to the test subject’s providers of health care, as defined in Section 56.05 of the Civil Code, except as described in paragraph (3), for purposes of diagnosis, care, or treatment of the patient. (2) (A) Notwithstanding Sections 120980 and 121010, the results of an HIV test that identifies or provides identifying characteristics of a Medi-Cal beneficiary may be disclosed by a provider of health care without written authorization of the subject of the test, or the subject’s representative as set forth in Section 121020, to the Medi-Cal managed care plan to which the beneficiary is assigned, if applicable, and to the external quality review organizations contracted by the State Department of Health Care Services to conduct external quality reviews of Medi-Cal managed care plans, for the purpose of administering quality improvement programs, including, but not limited to, value-based payment programs and healthy behavior incentive programs, designed to improve HIV care for Medi-Cal beneficiaries. (B) HIV test results that do not identify or provide identifying characteristics of the subjects of the tests may be disclosed without written authorization by the Medi-Cal managed care plan to State Department of Health Care Services staff for the purpose described in subparagraph (A). (3) Except for a Medi-Cal managed care plan to which a beneficiary is assigned, the results of an HIV test that identifies or provides identifying characteristics of the person to whom the test results apply may not be disclosed without written authorization of the subject of the test, or the subject’s representative, to a health care service plan regulated pursuant to Chapter 2.2 (commencing with Section 1340) of Division 2. (4) This subdivision shall be construed as being subject to Sections 120975 and 120980, including for purposes of individuals or entities described in this subdivision. (b) (1) Recording or disclosure of HIV test results pursuant to subdivision (a) does not authorize further disclosure unless otherwise permitted by law. (2) Paragraph (1) also applies to further disclosure to any federal agency or any authority in another state, unless otherwise required by federal law.