California Code, Insurance Code - INS § 10149.1

(a) This section shall apply to the disclosure of the results of a test for a genetic characteristic requested by an insurer pursuant to this article.

(b) Any person who negligently discloses results of a test for a genetic characteristic to any third party, in a manner which identifies or provides identifying characteristics of the person to whom the test results apply, except pursuant to a written authorization, as described in subdivision (g), or except as provided in this article or in Sections 1603.1 and 1603.3 of the Health and Safety Code, shall be assessed a civil penalty in an amount not to exceed one thousand dollars ($1,000) plus court costs, as determined by the court, which penalty and costs shall be paid to the subject of the test.

(c) Any person who willfully discloses the results of a test for a genetic characteristic to any third party, in a manner which identifies or provides identifying characteristics of the person to whom the test results apply, except pursuant to a written authorization, as described in subdivision (g), or except as provided in this article or in Sections 1603.1 and 1603.3 of the Health and Safety Code, shall be assessed a civil penalty in an amount not less than one thousand dollars ($1,000) and no more than five thousand dollars ($5,000) plus court costs, as determined by the court, which penalty and costs shall be paid to the subject of the test.

(d) Any person who willfully or negligently discloses the results of a test for a genetic characteristic to a third party, in a manner which identifies or provides identifying characteristics of the person to whom the test results apply, except pursuant to a written authorization, as described in subdivision (g), or except as provided in this article or in Sections 1603.1 and 1603.3 of the Health and Safety Code, which results in economic, bodily, or emotional harm to the subject of the test, is guilty of a misdemeanor punishable by imprisonment in a county jail for a period not to exceed one year, by a fine of not to exceed ten thousand dollars ($10,000), or by both that fine and imprisonment.

(e) Any person who commits any act described in subdivision (b) or (c) shall be liable to the subject for all actual damages, including damages for economic, bodily, or emotional harm which is proximately caused by the act.

(f) Each disclosure made in violation of this section is a separate and actionable offense.

(g) The applicant's “written authorization,” as used in this section, applies only to the disclosure of test results by a person responsible for the care and treatment of the person subject to the test. Written authorization is required for each separate disclosure of the test results, and shall include to whom the disclosure would be made.