Cal. Health & Safety Code § 1399.903

A disease management organization may receive medical information as provided in paragraph (17) of subdivision (c) of Section 56.10 of the Civil Code. However, a disease management organization shall be subject to the other provisions of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code), including, but not limited to, subdivisions (d) and (e) of Section 56.10 of, and Section 56.36 of, the Civil Code.