(a) Notwithstanding subdivision (c) of Section 56.10, except as provided in subdivision (e), no provider of health care, health care service plan, or contractor may release medical information to persons or entities who have requested that information and who are authorized by law to receive that information pursuant to subdivision (c) of Section 56.10, if the requested information specifically relates to the patient’s participation in outpatient treatment with a psychotherapist, unless the person or entity requesting that information submits to the patient pursuant to subdivision (b) and to the provider of health care, health care service plan, or contractor a written request, signed by the person requesting the information or an authorized agent of the entity requesting the information, that includes all of the following:

(1) The specific information relating to a patient’s participation in outpatient treatment with a psychotherapist being requested and its specific intended use or uses.

(2) The length of time during which the information will be kept before being destroyed or disposed of. A person or entity may extend that timeframe, provided that the person or entity notifies the provider, plan, or contractor of the extension. Any notification of an extension shall include the specific reason for the extension, the intended use or uses of the information during the extended time, and the expected date of the destruction of the information.

(3) A statement that the information will not be used for any purpose other than its intended use.

(4) A statement that the person or entity requesting the information will destroy the information and all copies in the person’s or entity’s possession or control, will cause it to be destroyed, or will return the information and all copies of it before or immediately after the length of time specified in paragraph (2) has expired.

(b) The person or entity requesting the information shall submit a copy of the written request required by this section to the patient within 30 days of receipt of the information requested, unless the patient has signed a written waiver in the form of a letter signed and submitted by the patient to the provider of health care or health care service plan waiving notification.

(c) For purposes of this section, “psychotherapist” means a person who is both a “psychotherapist” as defined in Section 1010 of the Evidence Code and a “provider of health care” as defined in Section 56.05.

(d) This section does not apply to the disclosure or use of medical information by a law enforcement agency or a regulatory agency when required for an investigation of unlawful activity or for licensing, certification, or regulatory purposes, unless the disclosure is otherwise prohibited by law.

(e) This section shall not apply to any of the following:

(1) Information authorized to be disclosed pursuant to paragraph (1) of subdivision (c) of Section 56.10.

(2) Information requested from a psychotherapist by law enforcement or by the target of the threat subsequent to a disclosure by that psychotherapist authorized by paragraph (19) of subdivision (c) of Section 56.10, in which the additional information is clearly necessary to prevent the serious and imminent threat disclosed under that paragraph.

(3) Information disclosed by a psychotherapist pursuant to paragraphs (14) and (22) of subdivision (c) of Section 56.10 and requested by an agency investigating the abuse reported pursuant to those paragraphs.

(f) Nothing in this section shall be construed to grant any additional authority to a provider of health care, health care service plan, or contractor to disclose information to a person or entity without the patient’s consent.

(Amended by Stats. 2013, Ch. 444, Sec. 3. (SB 138) Effective January 1, 2014.)