Cal. Welfare and Institutions Code § 14124.89

(a) (1) This section applies to all of the following entities: (A) Health insurer, or any health care entity licensed through the Department of Insurance. (B) Self-insured plan. (C) Group health plan, as defined in Section 607(1) of the Employee Retirement Income Security Act of 1974. (D) Service benefit plan. (E) Managed care organization, including a health care service plan as defined in subdivision (f) of Section 1345 of the Health and Safety Code, licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code). (F) Pharmacy benefit manager. (G) Third-party administrator. (H) Union trust. (I) Other party that is, by statute, contract, or agreement, legally responsible for payment of a claim for a health care item or service. (2) The entities listed in paragraph (1) shall, upon request of the department for any records, or any information contained in records pertaining to an individual or group health insurance policy or plan issued by such insurer or plan against, or pertaining to the medical or dental benefits paid by or claims made against such insurer or plan under a policy or plan, make the requested records or information available upon a certification by the department that the individual is an applicant for or recipient of services under this chapter or is a person who is legally responsible for such an applicant or recipient. (b) The entities listed in paragraph (1) of subdivision (a) shall enter into a cooperative agreement with the department setting forth mutually agreeable procedures for the provision of appropriate information, not inconsistent with any law pertaining to the confidentiality and privacy of medical records, at no cost to the department, within 90 days of the department’s request. (c) The information required to be made available pursuant to this section shall be limited to information necessary to determine whether health benefits have been or should have been claimed and paid pursuant to a health insurance policy or plan with respect to items of medical care and services received by a particular individual for which Medi-Cal coverage would otherwise be available. (d) Not later than the date upon which the procedures agreed to pursuant to subdivision (b) become effective, the director shall establish guidelines to assure that information relating to an individual certified to be an applicant for or recipient of medical assistance, furnished to any insurer or plan pursuant to this section, is used only for the purpose of identifying the records or information requested in such manner so as not to violate the confidentiality of an applicant or recipient.