California Code, Business and Professions Code - BPC § 26162

(a) Information identifying the names of patients, their medical conditions, or the names of their primary caregivers received and contained in records kept by the office or the department for the purposes of administering this chapter are confidential and shall not be disclosed pursuant to the California Public Records Act (Division 10 (commencing with Section 7920.000) of Title 1 of the Government Code), except as necessary for authorized employees of the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance.

(b) Information identifying the names of patients, their medical conditions, or the names of their primary caregivers received and contained in records kept by the department for the purposes of administering this chapter shall be maintained in accordance with Chapter 1 (commencing with Section 123100) of Part 1 of Division 106 of the Health and Safety Code, Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code, and other state and federal laws relating to confidential patient information.

(c) Nothing in this section precludes the following:

(d) Information shall not be disclosed by any state or local agency beyond what is necessary to achieve the goals of a specific investigation, notification, or the parameters of a specific court order or subpoena.