California Code, Civil Code - CIV § 56.20

(a) Each employer who receives medical information shall establish appropriate procedures to ensure the confidentiality and protection from unauthorized use and disclosure of that information. These procedures may include, but are not limited to, instruction regarding confidentiality of employees and agents handling files containing medical information, and security systems restricting access to files containing medical information.

(b) No employee shall be discriminated against in terms or conditions of employment due to that employee's refusal to sign an authorization under this part. However, nothing in this section shall prohibit an employer from taking such action as is necessary in the absence of medical information due to an employee's refusal to sign an authorization under this part.

(c) No employer shall use, disclose, or knowingly permit its employees or agents to use or disclose medical information which the employer possesses pertaining to its employees without the patient having first signed an authorization under Section 56.11 or Section 56.21 permitting such use or disclosure, except as follows:

(d) If an employer agrees in writing with one or more of its employees or maintains a written policy which provides that particular types of medical information shall not be used or disclosed by the employer in particular ways, the employer shall obtain an authorization for such uses or disclosures even if an authorization would not otherwise be required by subdivision (c).