Cal. Insurance Code § 799.10

(a) This section applies to the disclosure of the results of HIV tests requested by a life or disability income insurer pursuant to this article and, notwithstanding Section 120980 of the Health and Safety Code, Section 120980 of the Health and Safety Code does not apply to the disclosure of the results of HIV tests conducted pursuant to this article. (b) A person who negligently discloses results of an HIV test to a third party, in a manner that identifies or provides identifying characteristics of the person to whom the test results apply, except pursuant to a written authorization, as described in subdivision (g), or except as provided in this article or in Section 1603.1, 1603.3, or 121022 of the Health and Safety Code, or in any other law that expressly provides an exemption to this section, shall be assessed a civil penalty in an amount not to exceed two thousand five hundred dollars ($2,500) plus court costs, as determined by the court, which penalty and costs shall be paid to the subject of the test. (c) A person who willfully or maliciously discloses the results of an HIV test to a third party, in a manner that identifies or provides identifying characteristics of the person to whom the test results apply, except pursuant to a written authorization, as described in subdivision (g), or except as provided in this article or in Section 1603.1, 1603.3, or 121022 of the Health and Safety Code, or in any other law that expressly provides an exemption to this section, shall be assessed a civil penalty in an amount not less than five thousand dollars ($5,000) and not more than ten thousand dollars ($10,000) plus court costs, as determined by the court, which penalty and costs shall be paid to the subject of the test. (d) A person who willfully, maliciously, or negligently discloses the results of an HIV test to a third party, in a manner that identifies or provides identifying characteristics of the person to whom the test results apply, except pursuant to a written authorization, as described in subdivision (g), or except as provided in this article or in Section 1603.1, 1603.3, or 121022 of the Health and Safety Code, or in any other law that expressly provides an exemption to this section, that results in economic, bodily, or psychological harm to the subject of the test, is guilty of a misdemeanor punishable by imprisonment in a county jail for a period not to exceed 364 calendar days, or by a fine not to exceed twenty-five thousand dollars ($25,000), or by both that fine and imprisonment. (e) A person who commits any act described in subdivision (b) or (c) shall be liable to the subject for all actual damages, including damages for economic, bodily, or psychological harm that is proximately caused by the act. (f) Each disclosure made in violation of this section is a separate and actionable offense. (g) “Written authorization,” as used in this section, applies only to the disclosure of test results by a person responsible for the care and treatment of the person subject to the test. Written authorization is required for each separate disclosure of the test results, and shall include to whom the disclosure would be made.