1.  Authorized release.  The person who is the subject of an HIV test, at or near the time the entry is made in the medical record, shall elect, in writing, whether to authorize the release of that portion of the medical record containing the HIV infection status information when that person's medical record has been requested. A new election may be made when a change in the person's HIV infection status occurs or whenever the person makes a new election. The release form must clearly state whether or not the person has authorized the release of that information. The person must be advised of the potential implications of authorizing the release of that information.  

2.  Authorized disclosure.  A medical record containing results of an HIV test may not be disclosed, discoverable or compelled to be produced in any civil, criminal, administrative or other proceedings without the consent of the person who is the subject of an HIV test, except in the following cases:  

3.  Utilization review; research.  Nothing in this section may be interpreted to prohibit reviews of medical records for utilization review purposes by duly authorized utilization review committees or peer review organizations. Qualified personnel conducting scientific research, management audits, financial audits or program evaluation with the use of medical records may not identify, directly or indirectly, any individual patient in any report of such research, audit, evaluation or otherwise disclose the identities of persons tested in any manner.  

4.  Access by health care providers.  Nothing in this section may prohibit access to medical records by the designated health care provider of the person who is the subject of an HIV test in accordance with section 19203, subsection 2.  

5.  Confidentiality policy.  Health care providers and others with access to medical records containing HIV infection status information shall have a written policy providing for confidentiality of all patient information consistent with this chapter. That policy must require, at a minimum, action consistent with disciplinary procedures for violations of the confidentiality policy.  

6.  Access by health information exchange or other entity.  Nothing in this section precludes the disclosure of a medical record containing HIV information to a state-designated statewide health information exchange that provides and maintains an individual protection mechanism by which an individual may choose to opt in to allow the state-designated statewide health information exchange to disclose that individual's health care information covered under this section to a health care provider or health care facility consistent with the rules and regulations contained in the federal Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, for purposes of treatment, payment and health care operations, as those terms are defined in 45 Code of Federal Regulations, Section 164.501. A state-designated statewide health information exchange also must satisfy the requirement in Title 22, section 1711‑C, subsection 18, paragraph C of providing a general opt-out provision to an individual at all times.