Cal. Health & Safety Cod 11845.5.

The identity and records of the identity, diagnosis, prognosis, or treatment of any patient maintained in connection with any substance abuse treatment or prevention function conducted, regulated, or assisted by the state must be kept confidential and may only be disclosed for the following purposes:

• With the prior written consent of the individual who is the subject of the record, but only to the extent, under the circumstances, and for the purposes stated in the release of information signed by the client;
• In the course of providing services, between qualified professional persons employed by the treatment or prevention program;
• To qualified medical persons not employed by the treatment program in a bona fide medical emergency;
• To qualified personnel for the purpose of conducting scientific research, management audits, financial and compliance audits, or program evaluation, as long as no patient's identity is disclosed in any manner, including in a report of the research, audit, or evaluation; 
• With the prior written consent of the parent, guardian, or conservator of a minor, ward, or conservatee recipient of services, except that no professional person may be compelled to reveal information that has been given to him or her in confidence by members of the client's family;
• If authorized by a court after application showing probable cause, as provided in subdivision (c) of Section 1524 of the Penal Code. 

These restrictions continue to apply to records concerning any individual who has been a client, whether or not he or she ceases to be a client.