(

a) The Legislature finds and declares that the department performs public health activities described in

Section 164.512(

b) of Title of the Code of Federal Regulations when carrying out activities pursuant to this chapter. Personal information collected in accordance with this

chapter is necessary to carry out projects with public health purposes. (

b) All personal information obtained or maintained by the department shall be confidential and shall be subject to the following requirements:

(1) Only deidentified and aggregated information shall be included in a publicly available analysis, data product, or research.

(2) All policies and procedures developed in implementing this

chapter shall provide that the privacy, security, and confidentiality of consumers’ personal information is protected, as required by the Information Practices Act of 1977 (Chapter 1 (commencing with

Section 1798) of Title 1.8 of Part of Division of the Civil Code), and consistent with state and federal health privacy laws, including the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191) and the Confidentiality of Medical Information Act (Part 2.6 (commencing with

Section 56) of Division of the Civil Code). Data shall not be disclosed until the department has developed a policy regarding the release of data. (

c) Unless otherwise specified in this chapter, personal information collected by the department from other state entities shall be exempt from the disclosure requirements of the California Public Records Act (Division 10 (commencing with

Section 7920.000) of Title of the Government Code), and shall not be made available except pursuant to this chapter. (

d) Any information collected or obtained pursuant to this

chapter shall not be used for determinations regarding individual patient care or treatment and shall not be used for any individual eligibility or coverage decisions or similar purposes.