California Code, Civil Code - CIV § 56.25

(a) An employer that is a provider of health care shall not be deemed to have violated Section 56.20 by disclosing, in accordance with Chapter 2 (commencing with Section 56.10), medical information possessed in connection with providing health care services to the provider's patients.

(b) An employer shall not be deemed to have violated Section 56.20 because a provider of health care that is an employee or agent of the employer uses or discloses, in accordance with Chapter 2 (commencing with Section 56.10), medical information possessed by the provider in connection with providing health care services to the provider's patients.

(c) A provider of health care that is an employer shall not be deemed to have violated Section 56.10 by disclosing, in accordance with Chapter 3 (commencing with Section 56.20), medical information possessed in connection with employing the provider's employees. Information maintained by a provider of health care in connection with employing the provider's employees shall not be deemed to be medical information for purposes of Chapter 3 (commencing with Section 56.20), unless it would be deemed medical information if received or maintained by an employer that is not a provider of health care.