California Code, Business and Professions Code - BPC § 26162.5

(a) Identification cards issued pursuant to Section 11362.71 of the Health and Safety Code are hereby deemed “medical information” within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as (1) necessary for the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, Part 1 (commencing with Section 6001) and Part 14.5 (commencing with Section 34010) of Division 2 of the Revenue and Taxation Code, or a local ordinance, or (2) to a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain medical information for any other purpose or share information with any party other than the contracting licensee.

(b) Information contained in a physician's recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 and received by a licensee, including, but not limited to, the name, address, or social security number of the patient, the patient's medical condition, or the name of the patient's primary caregiver is hereby deemed “medical information” within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as (1) necessary for the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, Part 1 (commencing with Section 6001) and Part 14.5 (commencing with Section 34010) of Division 2 of the Revenue and Taxation Code, or a local ordinance, or (2) to a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain medical information for any other purpose or share information with any party other than the contracting licensee.