Cal. Health and Safety Code § 127673.82

(a) The department shall develop a comprehensive program for data use, access, and release that includes data use agreements that require data users to comply with this chapter. The purpose of the data use, access, and release program is to ensure that only aggregated, deidentified information is publicly accessible. (b) Access to nonpublic data shall be governed by the data use, access, and release program. (c) To meet the research and policy goals of the program, controlled access to nonpublic data by outside data analysts, researchers, and other qualified applicants is necessary. (d) The department shall establish a secure research environment for access to potentially identifiable information. The environment shall include access controls sufficient to ensure that users access only the data specified in an approved data request and that personal information is protected from unapproved use. (e) The department shall, with the advice of the advisory committee and data release committee, develop criteria, policies, and procedures for access to and release of nonpublic data. The policies shall be designed to recognize a patient’s right of privacy and shall include at least the privacy protection standards specified in Section 127673.83. (f) The department shall establish a pricing mechanism for the use of nonpublic data. (g) The department shall maintain information about requests and the disposition of requests, and shall develop processes for the timely consideration and release of nonpublic data.