138.7.

 (a) Except as expressly permitted in subdivision (b), a person or public or private entity not a party to a claim for workers’ compensation benefits shall not obtain individually identifiable information obtained or maintained by the division regarding that claim. For purposes of this section, “individually identifiable information” means any data concerning an injury or claim that is linked to a uniquely identifiable employee, employer, claims administrator, or any other person or entity.

(b) (1) (A) The administrative director, or a statistical agent designated by the administrative director, may use individually identifiable information for purposes of creating and maintaining the workers’ compensation information system as specified in Section 138.6.

(B) The administrative director may publish the identity of claims administrators in the annual report disclosing the compliance rates of claims administrators pursuant to subdivision (d) of Section 138.6.

(C) The administrative director shall use individually identifiable information for purposes of creating provider medical utilization data as specified in Section 138.8.

(2) (A) The State Department of Public Health may use individually identifiable information for purposes of establishing and maintaining a program on occupational health and occupational disease prevention as specified in Section 105175 of the Health and Safety Code.

(B) (i) The State Department of Health Care Services may use individually identifiable information for purposes of seeking recovery of Medi-Cal costs incurred by the state for treatment provided to injured workers that should have been incurred by employers and insurance carriers pursuant to Article 3.5 (commencing with Section 14124.70) of Chapter 7 of Part 3 of Division 9 of the Welfare and Institutions Code.

(ii) The Department of Industrial Relations shall furnish individually identifiable information to the State Department of Health Care Services, and the State Department of Health Care Services may furnish the information to its designated agent, provided that the individually identifiable information shall not be disclosed for use other than the purposes described in clause (i). The administrative director may adopt regulations solely for the purpose of governing access by the State Department of Health Care Services or its designated agents to the individually identifiable information as defined in subdivision (a).

(3) (A) Individually identifiable information may be used by the Division of Workers’ Compensation, the Division of Labor Standards and Enforcement, and the Division of Occupational Safety and Health as necessary to carry out their duties. The administrative director shall adopt regulations governing the access to the information described in this subdivision by these divisions. Any regulations adopted pursuant to this subdivision shall set forth the specific uses for which this information may be obtained.

(B) Individually identifiable information maintained in the workers’ compensation information system and the Division of Workers’ Compensation may be used by researchers employed by or under contract to the Commission on Health and Safety and Workers’ Compensation as necessary to carry out the commission’s research. The administrative director shall adopt regulations governing the access to the information described in this subdivision by commission researchers. These regulations shall set forth the specific uses for which this information may be obtained and include provisions guaranteeing the confidentiality of individually identifiable information. Individually identifiable information obtained under this subdivision shall not be disclosed to commission members. Individually identifiable information obtained by researchers under contract to the commission pursuant to this subparagraph may not be disclosed to any other person or entity, public or private, for a use other than that research project for which the information was obtained. Within a reasonable period of time after the research for which the information was obtained has been completed, the data collected shall be modified in a manner so that the subjects cannot be identified, directly or through identifiers linked to the subjects.

(C) Individually identifiable information may be used by the Office of Self-Insurance Plans of the Department of Industrial Relations as necessary to carry out its duties, including evaluating the costs of administration, workers’ compensation benefit expenditures, and solvency and performance of the public self-insured employers’ workers’ compensation programs.

(4) The administrative director shall adopt regulations allowing reasonable access to individually identifiable information by other persons or public or private entities for the purpose of bona fide statistical research. This research shall not divulge individually identifiable information concerning a particular employee, employer, claims administrator, or any other person or entity. The regulations adopted pursuant to this paragraph shall include provisions guaranteeing the confidentiality of individually identifiable information. Within a reasonable period of time after the research for which the information was obtained has been completed, the data collected shall be modified in a manner so that the subjects cannot be identified, directly or through identifiers linked to the subjects.

(5) (A) This section does not exempt from disclosure any information that is considered to be a public record pursuant to the California Public Records Act (Division 10 (commencing with Section 7920.000) of Title 1 of the Government Code) contained in an individual’s file once an application for adjudication has been filed pursuant to Section 5501.5.

(B) Individually identifiable information shall not be provided to any person or public or private entity who is not a party to the claim unless that person self-identifies or that public or private entity identifies itself and states the reason for making the request. The administrative director may require the person or public or private entity making the request to produce information to verify that the name and address of the requester is valid and correct. If the purpose of the request is related to preemployment screening, the administrative director shall notify the person about whom the information is requested that the information was provided and shall include the following in 12-point type:

“IT MAY BE A VIOLATION OF FEDERAL AND STATE LAW TO DISCRIMINATE AGAINST A JOB APPLICANT BECAUSE THE APPLICANT HAS FILED A CLAIM FOR WORKERS’ COMPENSATION BENEFITS.”

(C) Any residence address is confidential and shall not be disclosed to any person or public or private entity except to a party to the claim, a law enforcement agency, an office of a district attorney, any person for a journalistic purpose, or other governmental agency.

(D) This paragraph does not prohibit the use of individually identifiable information for purposes of identifying bona fide lien claimants.

(c) Except as provided in subdivision (b), individually identifiable information obtained by the division is privileged and is not subject to subpoena in a civil proceeding unless, after reasonable notice to the division and a hearing, a court determines that the public interest and the intent of this section will not be jeopardized by disclosure of the information. This section does not restrict access to information by any law enforcement agency or district attorney’s office nor limit admissibility of that information in a criminal proceeding.

(d) It is unlawful for any person who has received individually identifiable information from the division pursuant to this section to provide that information to any person who is not entitled to it under this section.