(a) Personal data in any investigations, reports, and information relating thereto shall be kept confidential and be afforded protections provided by Section 100330, except as provided by Section 1603.1 or 1603.3.
(b) If patient-identifying information is subpoenaed from the department, the department shall seek and the court shall issue a protective order keeping this information confidential. The court order may require production, but limit the use and disclosure of, records, require production with names and identifying information deleted, provide sanctions for misuse of records or set forth other methods for assuring confidentiality.